Lessons Learned from CISA’s Recent GitHub Leak

CISA published a postmortem after a contractor left 844 MB of sensitive agency data — including AWS GovCloud admin keys and plaintext internal credentials — in a public GitHub repository for about six months; GitGuardian notified CISA, which took over 48 hours to rotate keys, and the agency reports no evidence the leaked credentials were used externally while outlining remediation steps (key rotation, access revocation) and recommendations for continuous secrets scanning and clearer researcher reporting channels.