CISA GitHub Leak Exposes AWS GovCloud Keys – Lessons for Security Teams

CISA GitHub Leak Reveals Critical Cloud Credentials

On May 15, 2026, GitGuardian flagged a public repository named “Private CISA” that housed 844 MB of agency data, including admin keys for three AWS GovCloud instances. The CISA GitHub leak lingered for ↓ 6 months before KrebsOnSecurity reported it, giving attackers a window of opportunity.

Initial acknowledgment arrived within hours, yet revoking the exposed keys took ↓ 48 hours. CISA attributes the delay to tangled inter‑agency dependencies and legacy processes.

“Clear, dedicated reporting channels are non‑negotiable,” wrote Preston Werntz, acting CIO, in the agency’s postmortem.

GitGuardian researcher Guillaume Valadon noted nine automated alerts were ignored, turning a one‑day breach into a half‑year exposure. He urges organizations to publish security guidance beyond a single security.txt file, placing instructions where reporters, contractors, and researchers can see them.

The agency’s internal playbook lacked a GitHub‑specific response, a gap now slated for remediation. Continuous scanning of public code, not quarterly audits, is now a mandated practice.

Despite the slip, CISA scored itself well on zero‑trust architecture and logging, proving no customer data was accessed. The contractor’s access was revoked, and all secrets have been rotated.

Experts view the transparent postmortem as a benchmark. As Valadon put it, “For a national cyber agency to champion secret‑scanning and researcher collaboration is a first‑of‑its‑kind signal for the entire sector.”