Mon, 18 May 2026
← BackUntil this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history. On May 15, KrebsOnSecurity heard from Guillaume Valadon, a researcher with the security firm GitGuardian. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures.
Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. A redacted screenshot of the now-defunct “Private CISA” repository maintained by a CISA contractor. The GitHub repository that Valadon flagged was named “Private-CISA,” and it harbored a vast number of internal CISA/DHS credentials and files, including cloud keys, tokens, plaintext passwords, logs and other sensitive CISA assets. Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH...
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history. On May 15, KrebsOnSecurity heard from Guillaume Valadon, a researcher with the security firm GitGuardian. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures.
Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. A redacted screenshot of the now-defunct “Private CISA” repository maintained by a CISA contractor. The GitHub repository that Valadon flagged was named “Private-CISA,” and it harbored a vast number of internal CISA/DHS credentials and files, including cloud keys, tokens, plaintext passwords, logs and other sensitive CISA assets. Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.
“Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature,” Valadon wrote in an email. “I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career. It is obviously an individual’s mistake, but I believe that it might reveal internal practices.” One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers.
Another file exposed in their public GitHub repository — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems. According to Caturegli, those systems included one called “LZ-DSO,” which appears short for “Landing Zone DevSecOps,” the agency’s secure code development environment. Philippe Caturegli, founder of the security consultancy Seralys, said he tested the AWS keys only to see whether they were still valid and to determine which internal systems the exposed accounts could access. Caturegli said the GitHub account that exposed the CISA secrets exhibits a pattern consistent with an individual operator using the repository as a working scratchpad or synchronization mechanism rather than a curated project repository.
“The use of both a CISA-associated email address and a personal email address suggests the repository may have been used across differently configured environments,” Caturegli observed. “The available Git metadata alone does not prove which endpoint or device was used.” The Private CISA GitHub repo exposed dozens of plaintext credentials for important CISA GovCloud resources. Caturegli said he validated that the exposed credentials could authenticate to three AWS GovCloud accounts at a high privilege level. He said the archive also includes plain text credentials to CISA’s internal “artifactory” — essentially a repository of all the code packages they are using to build software — and that this would represent a juicy target for malicious attackers looking for ways to maintain a persistent foothold in CISA systems.
“That would be a prime place to move laterally,” he said. “Backdoor in some software packages, and every time they build something new they deploy your backdoor left and right.” In response to questions, a spokesperson for CISA said the agency is aware of the reported exposure and is continuing to investigate the situation. “Currently, there is no indication that any sensitive data was compromised as a result of this incident,” the CISA spokesperson wrote. “While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.” A review of the GitHub account and its exposed passwords show the “Private CISA” repository was maintained by an employee of Nightwing, a government contractor based in Dulles, Va.
Nightwing declined to comment, directing inquiries to CISA. CISA has not responded to questions about the potential duration of the data exposure, but Caturegli said the Private CISA repository was created on November 13, 2025. The contractor’s GitHub account was created back in September 2018. The GitHub account that included the Private CISA repo was taken offline shortly after both KrebsOnSecurity and Seralys notified CISA about the exposure.
But Caturegli said the exposed AWS keys inexplicably continued to remain valid for another 48 hours. CISA is currently operating with only a fraction of its normal budget and staffing levels. The agency has lost nearly a third of its workforce since the beginning of the second Trump administration, which forced a series of early retirements, buyouts, and resignations across the agency’s various divisions. The now-defunct Private CISA repo showed the contractor also used easily-guessed passwords for a number of internal resources; for example, many of the credentials used a password consisting of each platform’s name followed by the current year.
Caturegli said such practices would constitute a serious security threat for any organization even if those credentials were never exposed externally, noting that threat actors often use key credentials exposed on the internal network to expand their reach after establishing initial access to a targeted system. “What I suspect happened is [the CISA contractor] was using this GitHub to synchronize files between a work laptop and a home computer, because he has regularly committed to this repo since November 2025,” Caturegli said. “This would be an embarrassing leak for any company, but it’s even more so in this case because it’s CISA.” This entry was posted on Monday 18th of May 2026 04:48 PM I’m not MAGA or a Trump fan. Blaming him for this?
#BRUH Where does the buck stop? meh…while this is anecdotal (only one person / issue), it certainly erodes confidence in the broad statement about only hiring the best. When the researcher who found it thinks its all fake (maybe a honey pot?) because the exposure is THAT BAD, CISA needs to do better. Better funding may help, prior administration wanted to increase CISA funding, current administration is decreasing CISA funding.
You get what you pay for? Th entire agency is a boomdoggl waste. This falls squarely on the trump administration for cutting valuable workers in the cyber security sector. It’s absolutely related.
You get what you pay for. If a president gives free reign to people to intentionally tear down and weaken federal government resources designed to protect and manage this kind of stuff, then yes, he is to blame. Directly. No doubts about that.
Take your overdefensive MAGA stuff to a Fox “News” Facebook page where it will be appreciated by those who don’t know any better. America Government’s cybersecurity agency making one of the biggest beginner mistakes possible in cybersecurity? If it wasn’t Trump administration, I would call Fake News. This is not surprising, although still important.
What struck me most is the fact that these things happen most likely because of constant de-funding, de-resourcing, and de-prioritization… it’s the same as in private business / public companies, when they cut things to the bone, these results are foreseeable / predictable. What is annoying more than anything is that this is the agency (CISA) that is supposed to tell the (rest of the) industry how to do security… well, start cleaning up your own mess first before you tell others to is probably a good advice to them. This was so sadly predictable. The current administration deployed security naifs through DOGE to rake through confidential taxpayer records and then toyed with CISA’s funding with no apparent agenda except to sow disruption and confusion.
Meanwhile, CISA makes available valuable and cost-effective vulnerability scans to organizations affiliated with any of the 16 critical economic sectors, including K-12 schools and their technology providers. I do question, however, why anyone with a security background would use file names like “important AWS tokens” or “AWS workspace passwords.” Are you kidding me? The contractor should provide its employees with training that includes naming conventions. A little obfuscation can be useful.
The thing is, also included in the Private-CISA repo were all of the certifications this guy earned for security training. He’d been through a dozen different courses with flying colors. I call it like I see it. GROWING PAINS.
We already know that .gov is usually behind the curve on IT This is not a result of Budget cuts, but a result of a completely incompetent individual who was given access to information they clearly could not be trusted to manage. In addition, this basic level of security has been known since the dawn of the internet and even before. Even my 90 year old father knows how to protect his information. The policy and practices to avoid this type of breach should have been in place 40+ years ago.
Budget cuts can lead to squeezing everyone for resources and extra work which (in my experience) can cause situations where people not qualified to handle information end up with it in their hands. We didn’t see this kind of thing happen until resources were slashed. Is it coincidence? It’s amazing watching CISA publish issue after issue after issue but nothing but crickets on their own dirty laundry 🙁 Your email address will not be published.
Required fields are marked * Comment * Name * Email * Website Δ Mailing List Search KrebsOnSecurity Recent Posts Story Categories Why So Many Top Hackers Hail from Russia