A contractor repo and cloud keys: CISA’s lessons

In May 2026 a CISA contractor uploaded a copy of a CISA build and deployment repository — including Infrastructure as Code and admin/build credentials for AWS GovCloud — to a personal public GitHub repository. A researcher discovered the exposed credentials and reported them; CISA took the repository offline, revoked access, rotated credentials across administrator scopes, tightened repository upload controls, and created a GitHub/cloud incident playbook. CISA reported no evidence the credentials were used outside its environments or that customer/mission data were exposed, but highlighted slow rotation, gaps in reporting channels, and the need for better monitoring of exposed secrets.