CISA Publishes Candid Postmortem After Contractor Leaks Sensitive AWS and Internal Credentials on GitHub

The Cybersecurity and Infrastructure Security Agency (CISA) has released a remarkably transparent postmortem report detailing a significant data leak that exposed dozens of internal credentials, including highly sensitive Amazon Web Services (AWS) GovCloud keys. The breach occurred after an external contractor inadvertently published the private data to a public GitHub repository, where it remained completely exposed for nearly half a year. The incident went unnoticed by the federal agency’s internal monitoring systems until external security researchers intervened.

The newly published retrospective offers a rare look into the internal crisis response of a national cybersecurity authority. While CISA’s report highlights several areas where its zero-trust architecture and robust logging prevented broader catastrophe, it simultaneously lays bare critical vulnerabilities in the agency’s external communications, third-party risk management, and incident triage workflows. Security experts across the private sector have lauded CISA for its candor, pointing out that the lessons learned from this six-month exposure serve as a vital blueprint for enterprise security teams navigating the complexities of modern cloud infrastructure and contractor oversight.

Anatomy of a Six-Month Exposure

The incident originated from what has become a frustratingly common vector in modern cybersecurity architecture: human error combined with a lack of continuous external visibility. A third-party contractor working with CISA created a public GitHub repository titled "Private CISA," packing it with approximately 844 megabytes of sensitive, agency-related information.

Among the files left unprotected in the repository was a document explicitly named "importantAWStokens," which housed administrative access keys for three separate Amazon AWS GovCloud servers. In high-security environments like those governing federal infrastructure, AWS GovCloud keys represent the crown jewels; compromise of these credentials can grant malicious actors deep visibility into, and potential control over, critical government workloads. Furthermore, the repository exposed a file titled "AWS-Workspace-Firefox-Passwords.csv," which contained plaintext usernames and passwords for dozens of internal CISA operational systems.

For nearly six months, this treasure trove of credentials sat completely exposed to anyone browsing public code repositories. The lapse underscores a persistent blind spot in traditional security perimeters: organizations often focus heavily on securing internal networks while failing to monitor where developers and contractors store authentication tokens, configuration files, and backup data during the software development lifecycle.

Chronology of the Incident and External Discovery

The timeline of the breach highlights a systemic failure in automated alerting infrastructure and external vulnerability intake processes. The chronology of discovery and response unfolded over several critical phases:

• November 2025 – May 2026: The "Private CISA" repository remains active and public on GitHub. During this six-month window, automated secrets-scanning technology operated by the security firm GitGuardian detects the exposed tokens and issues at least nine automated notification emails to the accounts associated with the leak. These warnings go completely unanswered.
• May 15, 2026: Guillaume Valadon, a researcher at GitGuardian, recognizes the severity of the exposed CISA credentials and escalates the issue by contacting investigative journalist Brian Krebs at KrebsOnSecurity to ensure the message reaches the appropriate authorities.
• May 15–17, 2026: CISA acknowledges the initial outreach from security researchers rapidly. However, due to administrative complexities and deep interconnections with federal partners, the agency requires more than 48 hours to fully revoke and rotate the compromised AWS keys and associated internal secrets.
• Late May 2026: CISA revokes the contractor’s system access and initiates a comprehensive internal audit to trace the scope of the exposure.
• August 2026: CISA publishes its formal postmortem report, authored by Acting Chief Information Officer Preston Werntz and Acting Chief Information Security Officer Brad Libbey, detailing the failures and outlining corrective action plans.

The Bottlenecks of Bureaucracy and Triage

One of the most revealing admissions in CISA’s postmortem report concerns its breakdown in handling external vulnerability notifications. When security researchers attempt to report vulnerabilities affecting a major cybersecurity agency, the reporting pathways must be frictionless, immediate, and unambiguous. In this instance, however, CISA’s communication channels were ill-defined.

Faced with unanswered automated alerts, researchers had to resort to a fragmented approach. They attempted to email the contractor directly, submitted reports through CISA’s standard vulnerability disclosure platform—which is intentionally designed for vulnerabilities impacting the broader public and private cybersecurity ecosystem, rather than CISA’s own internal infrastructure—and ultimately relied on investigative journalism to force an escalation.

This structural confusion meant that a notification meant for internal infrastructure security mistakenly landed in a product-bug or general vulnerability queue. In their analysis, Werntz and Libbey noted that organizations must establish clear, distinct reporting channels that separate incidents affecting internal operations from those involving external products or customers.

Furthermore, the incident exposed a gap in CISA’s pre-existing incident response playbooks. While the agency maintained comprehensive operational playbooks for standard cyber threats, those documents inexplicably lacked specific protocols for addressing credential leaks on cloud-hosted code repositories like GitHub.

The Challenge of Key Rotation in Federal Environments

When CISA finally received actionable intelligence regarding the leaked AWS GovCloud keys, neutralizing the threat was not as simple as flipping a switch. The agency’s postmortem reveals that the key rotation process took over 48 hours—an eternity in active incident response where leaked administrative credentials are concerned.

CISA attributed this delay to the complex, interdependent nature of federal systems. Modern cloud architectures are rarely isolated; they feature intricate webs of access controls, service accounts, and API integrations connecting federal agencies with industry partners and other government bodies. Revoking an administrative key prematurely can cause cascading operational failures, disrupting critical services and monitoring tools.

Consequently, the agency had to systematically map out every system reliant on the compromised keys before forcing a rotation. In its report, CISA urged other organizations to use this incident as a cautionary tale, emphasizing the necessity of maintaining mature, well-tested key management capabilities that allow for rapid, frictionless credential revocation without collateral damage to operational readiness.

Silver Linings: Zero-Trust and Comprehensive Logging

Despite the severe nature of the initial exposure and the sluggish remediation window, CISA’s postmortem highlighted several areas where modern security engineering successfully mitigated the fallout.

Because the agency had previously invested heavily in zero-trust principles across both its production and development environments, and had implemented enhanced logging capabilities, security analysts were able to conduct a rapid forensic investigation. These detailed logs provided concrete evidence that the exposed credentials were never exploited by malicious actors. CISA confirmed that no customer data, mission-critical files, or external federal systems were accessed during the six-month window the repository was live.

Additionally, the contractor responsible for the leak faced immediate administrative consequences, with their system access permanently revoked. CISA utilized the event to transition from periodic code scanning to continuous, automated secrets monitoring across external repositories, integrating these controls into its broader enterprise risk management strategy.

Industry Reactions and Broader Implications

The cybersecurity community’s reaction to CISA’s transparency has been overwhelmingly positive. Guillaume Valadon of GitGuardian praised the agency for breaking with traditional government protocol by openly discussing its operational missteps.

"Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure," Valadon wrote in a follow-up analysis. "Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat."

Valadon noted that this marks the first time a national cybersecurity agency has publicly advocated for widespread automated secrets scanning and for simplifying the friction between enterprises and independent security researchers. By publishing the postmortem, CISA has effectively shifted the narrative from institutional perfection to continuous operational improvement.

The broader implications for enterprise and government security teams are clear. Third-party risk management cannot end at the signing of a vendor contract; it must extend to continuous oversight of developer environments, shared code repositories, and credential storage practices. Organizations must audit their public-facing footprints proactively, recognizing that automated alerts from platforms like GitGuardian or GitHub are early warning systems that demand immediate, prioritized triage.

Ultimately, while the CISA data leak highlights the pervasive risks of human error in cloud environments, the agency’s subsequent accountability sets a gold standard for incident transparency. By acknowledging its failures in communication, incident playbooks, and key rotation speed, CISA has provided the cybersecurity industry with an invaluable roadmap for turning an embarrassing operational failure into a defining lesson in resilience.