CISA GitHub Leak: How 844MB of US Government Cloud Keys Sat Exposed for Six Months

The Repository That Shouldn’t Have Existed

On May 14, 2026, Guillaume Valadon, a researcher at GitGuardian, flagged a public GitHub repository named “Private-CISA.” The name was aspirational. The repository was entirely public, and it had been accessible since November 13, 2025 — roughly six months.

Inside were 844 MB of data that should never have left a federal secure environment: administrative-level AWS GovCloud account keys stored in a file literally named “importantAWStokens,” plaintext passwords in a CSV titled “AWS-Workspace-Firefox-Passwords.csv,” a Kubernetes cluster configuration file (kube-config.txt), SSH authentication keys, Entra ID SAML certificates, CI/CD build logs, deployment workflows, and Terraform infrastructure code.

The repository belonged to an employee of Nightwing, a government contractor based in Dulles, Virginia, according to Krebs on Security. The contractor had apparently been using a personal GitHub account as a “working scratchpad,” mixing a CISA-issued contractor email with a personal Yahoo address in the same Git history — creating a documented bridge between a classified federal environment and an unmonitored personal cloud service. Nightwing declined to comment.

GitGuardian’s automated scanning system had already sent nine alert emails to the commit author before Valadon escalated. No action was taken. CyberScoop reported the repository was taken offline at approximately 6:00 PM EST on May 15, 2026 — roughly 26 hours after GitGuardian’s direct notification to CISA.

What Was Actually Inside — and Why It Matters

The contents of the “Private-CISA” repository represent more than a single contractor’s carelessness. Read as a set, they map CISA’s internal cloud architecture with unusual precision.

The AWS GovCloud keys were described as administrative-level — meaning the holder could provision, modify, or delete cloud resources at will, not merely read them. The Kubernetes manifests gave anyone who looked a detailed picture of CISA’s container orchestration topology. The CI/CD logs and GitHub Actions workflows exposed how CISA builds and deploys software internally, including pipeline dependencies and integration points. The Artifactory credentials — a private software artifact repository — would have enabled lateral movement deeper into CISA’s software supply chain.

Perhaps most damaging was what the passwords themselves revealed. Cybersecurity News reported that many credentials followed the pattern “platformname + current year” — for instance, a password like “AWS2026.” This is the kind of predictable credential structure that automated brute-force and credential stuffing attacks are built to exploit. The contractor had also deliberately disabled GitHub’s built-in secret-scanning protection, a feature that would have flagged or blocked the push of credentials. Disabling that protection requires an active choice — it does not happen by accident.

The 48-hour delay in rotating the exposed AWS keys after the repository was removed is a separate and compounding failure. Akeyless documented that the keys remained valid for two full days following the takedown, meaning anyone who had copied the credentials during the six-month window continued to have live access long after the primary exposure was remediated.

What CISOs and Security Teams Should Do About It

The CISA incident is a composite of at least five distinct, independently preventable failures. Understanding them separately is what converts a news story into a policy checklist.

1. Treat Static Long-Lived Credentials as a Design Defect, Not a Policy Problem

The deepest lesson here is architectural. The contractor had a file named “importantAWStokens” because the system issued credentials in a form that could be stored and filed. Static, long-lived cloud credentials — API keys that don’t expire, SSH keys that live in files — are the class of secret most likely to appear in GitHub repositories, Slack messages, and incident logs.

The alternative is not “better training.” It is systems that don’t issue static secrets at all. AWS IAM supports short-lived session tokens via STS (Security Token Service); these expire within 15 minutes to 12 hours and cannot be re-used after expiry. Kubernetes supports workload identity federation that binds a pod’s identity to a cloud IAM role without credentials ever being written to disk. Organizations running government or regulated workloads should audit every place a static key is required and document a migration plan to short-lived tokens or OIDC-based authentication. If a secret must be stored anywhere — a file, a password manager, a CI/CD variable — it should be treated as compromised by default until proven otherwise.

2. Deploy Secrets Detection at the Push Layer, Not the Audit Layer

GitGuardian sent nine automated alerts before a human escalated. The contractor ignored them all — and had disabled GitHub’s native push protection to ensure they could be ignored. This is a common pattern: detection that occurs after a secret is committed is reactive, not preventive. Push protection that blocks a commit before it reaches the remote repository is preventive.

Every organization with a code repository should enable GitHub Advanced Security’s push protection (or the equivalent for GitLab, Bitbucket, or Azure DevOps) and configure it so that developers cannot disable it without an explicit override request that gets logged and reviewed. The override — not the block — is what should generate an alert to the security team. In CISA’s case, the presence of a disabled push protection setting should itself have been a monitored anomaly in any reasonably mature secrets management audit.

3. Define, Test, and Time-Box Credential Revocation as a Formal Incident Response Step

The 48-hour window in which compromised AWS GovCloud keys remained valid after the repository was removed is the part of this incident that will define its legal and regulatory exposure. For a federal agency, any system whose keys were accessible during those 48 hours must now be treated as potentially compromised, requiring forensic logging review, access pattern analysis, and conditional re-certification of those environments.

Credential revocation must be a named, tested step in your incident response playbook — not an informal “someone will rotate it.” The test should include a scheduled fire drill where a credential is reported compromised and the team races to revoke and replace it within a defined time window. NIST 800-61r3 recommends credential rotation be completed within one business hour for high-impact systems. CISA’s response took 48 hours. Security teams should measure and publish their own mean-time-to-revoke as a key performance indicator alongside mean-time-to-detect and mean-time-to-respond.

4. Enforce Contractor Identity Separation at the Repository Level

The “bridge” that enabled this incident was structural: a federal contractor mixed a government-issued email with a personal Yahoo address in the same Git commit history, and used a personal GitHub account to store government work. Neither CISA’s onboarding process nor Nightwing’s contractor management procedures appear to have enforced repository-level separation.

Enterprise GitHub (and GitHub Enterprise Server for government) supports identity verification policies that require commits to be signed by an organization-issued identity. Any repository touching government infrastructure should enforce this policy. Contractor agreements should include explicit clauses prohibiting the use of personal repository accounts for any work-related code or configuration, with audit provisions. In a government context, these clauses carry legal weight under the Federal Acquisition Regulation (FAR) security provisions — and their absence in the Nightwing contract, if confirmed, represents a procurement oversight.

The Bigger Picture: Workforce Cuts and the Security Debt They Create

Congress noticed this incident immediately. Rep. Bennie Thompson and Rep. Delia Ramirez of the House Homeland Security Committee sent a letter on May 26, 2026 requesting a staff-level briefing on “how this serious security lapse occurred, any potential security consequences, remediation activities, corrective actions related to the contractor personnel involved, and efforts to monitor for and prevent similar activity.” Sen. Maggie Hassan sent a separate letter the same day seeking a classified briefing.

Both letters referenced something the Krebs on Security report also noted: CISA has lost approximately one-third of its workforce since early 2025, through a combination of retirements, voluntary buyouts, and resignations in the context of federal budget pressures. Hassan wrote: “This reported incident raises serious questions about how such a security lapse could occur at the very agency charged with helping to prevent cyber breaches.”

That framing points to a structural dynamic that extends well beyond one contractor’s careless commit. When an organization loses a third of its staff in a compressed timeframe, three things happen simultaneously: institutional knowledge of safe operating procedures leaves with experienced employees; oversight of contractor personnel — who must fill the gaps — becomes thinner and less rigorous; and the psychological contract that keeps engineers from cutting corners on personal security hygiene erodes. The contractor who disabled GitHub push protection was not operating in a well-supervised environment.

The CISA incident is therefore a data point in a larger argument about the security consequences of federal workforce reduction. Secrets management tools, short-lived credentials, and push protection policies are technical controls — but they require the human capacity to configure, monitor, and enforce them. Budget decisions made in Washington have operational consequences measured in exposed cloud keys.

Frequently Asked Questions

Sources & Further Reading

• CISA Admin Leaked AWS GovCloud Keys on GitHub — Krebs on Security
• How We Got a CISA GitHub Leak Taken Down in Under a Day — GitGuardian Blog
• CISA Credential Leak Raises Alarms, and Capitol Hill Demands Answers — CyberScoop
• CISA’s GitHub Leak Exposed a Static Secrets Problem — Akeyless
• CISA Admin Exposes AWS GovCloud Credentials on Public GitHub Repository — Cybersecurity News