CISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months

A contractor published a GitHub repository named "Private CISA" publicly, exposing roughly 844 MB of agency data for about six months. It included AWS GovCloud administrative credentials in a file called importantAWStokens and dozens of internal system usernames and passwords in plaintext, in a file named AWS-Workspace-Firefox-Passwords.csv. Nine automated GitGuardian alerts went unanswered before researcher Guillaume Valadon contacted KrebsOnSecurity on 15 May 2026. CISA's own stated lessons are a fair list: reporting channels for incidents kept distinct from product vulnerability reports, continuous secrets scanning rather than periodic review, incident playbooks that cover cloud services such as GitHub, security.txt in prominent places, and better key rotation across federal and partner systems.

Why it matters

The failure that costs the most here is not the misconfigured repository, it is the nine unanswered alerts. Detection worked. The path from a detection to a human who could act on it did not exist, which is the same gap most organisations have and few test.

Two practical points. First, a repository named "Private" is a naming convention, not a control, and the file names show a workflow where secrets in source are normal rather than exceptional. Fix the workflow with a secrets management service and pre-commit scanning, not with training.

Second, when the leaked credential is an administrative cloud key, rotation across interconnected partner systems is itself a project, which is why standing admin keys should not exist. Prefer short-lived credentials: see zero standing privileges.

Source: KrebsOnSecurity