IC Technology & Cyber — 2026-07-14

CISA Publishes Postmortem on Six-Month GitHub Credential Leak Exposing AWS GovCloud Keys

BLUFCISA's credibility as the federal government's cybersecurity standard-setter erodes when its own credential hygiene failures mirror the exact lapses it routinely warns agencies to fix.

CISA published an after-action report Thursday describing a leak in which a Nightwing contractor uploaded a CISA build-and-deployment repository containing AWS GovCloud administrator keys and plaintext passwords for dozens of internal systems to a personal GitHub account 123. GitGuardian found the 844 MB repository, dubbed "Private-CISA," in mid-May and said nine automated alerts to the account went unanswered before researcher Guillaume Valadon contacted journalist Brian Krebs, whose inquiry led CISA to remove it 14. CISA said it revoked the contractor's access, reset credentials across affected environments, and rotated the leaked AWS keys, a process that took over 48 hours due to system complexity 13. The agency said log analysis found no unauthorized use of the credentials or exposure of customer or mission data, and acknowledged the repository had remained public for roughly six months 34.

Analysis
CISA's after-action report rests entirely on its own log analysis, the sole evidence for ruling out unauthorized use of the exposed GovCloud administrator keys, with Krebs on Security, SC Media, Cybersecurity Dive and GitGuardian merely amplifying that single primary document rather than corroborating it independently. Nine unanswered GitGuardian alerts and a rotation process exceeding 48 hours point to systemic gaps in outward-facing vulnerability triage and brittle credential management across CISA's interconnected systems, not an isolated contractor error. Publishing a postmortem at all is unusual for a national cybersecurity agency and reads as remediation staged for congressional and industry scrutiny rather than internally driven. The clean finding leaves open whether a more patient or sophisticated actor exploited the six-month public exposure window undetected, since only CISA's internal logs stand behind the claim that no such access occurred.

5 sources

Lessons Learned from CISA's Recent GitHub Leak - Krebs on Security
CISA shares postmortem of GitHub credential leak - SC Media
CISA details security lapses that led to GitHub leak of passwords, cloud access keys - Cybersecurity Dive
What CISA Got Right After Its GitHub Leak: Lessons Every Organization Should Copy - GitGuardian
Lessons from CISA's Cyber Incident - CISA (Cybersecurity and Infrastructure Security Agency)