Lessons Learned from CISA's Recent GitHub Leak

The CISA postmortem details a contractor accidentally publishing dozens of internal CISA credentials, including AWS GovCloud access keys, to a public GitHub repository for nearly six months; the report outlines the exposure, highlights the irony given CISA's own guidance, and provides practical recommendations such as automated secret scanning, enforcing least-privilege, immediate rotation of exposed credentials, and stronger contractor security controls.