US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals

CISA lacked a prepared incident-response playbook after a contractor accidentally uploaded sensitive access keys and credentials to a public GitHub repository; a security researcher and journalist notified the agency, which removed the repository and revoked the credentials. The postmortem noted no customer or mission data was exposed, criticized unclear channels for researchers to report incidents, and tied the agency's response shortfalls to staffing and leadership gaps.