CISA, the agency that defends US federal networks, left its own AWS keys on GitHub

A GitGuardian researcher named Guillaume Valadon was sifting through public GitHub commits when he hit a repository whose name read like a mistake: Private-CISA. It belonged to a contractor for the Cybersecurity and Infrastructure Security Agency, the federal body charged with defending US government networks, and inside were administrative credentials for three AWS GovCloud accounts, a comma-separated file of plaintext usernames and passwords for dozens of internal CISA systems, and step-by-step notes on how the agency builds, tests and deploys its own software. The contractor had also turned off the GitHub feature that scans pushes for exposed secrets.

Two filenames in the Private-CISA tree do most of the damage on their own. One, importantAWStokens, lists the admin keys for the three GovCloud servers. The other, AWS-Workspace-Firefox-Passwords.csv, is exactly what it sounds like: a Firefox password export, in clear text, covering internal CISA workspaces, the agency’s artifactory of internal code packages, and its Landing Zone DevSecOps environment, the controlled space where federal teams write and review classified-adjacent code. There is no encryption layer, no vault reference, no token rotation logic. It is a CSV.

AWS GovCloud is the isolated cloud region Amazon runs for US government workloads that have to stay inside FedRAMP High and similar compliance frames. Admin-level keys in that region are not standard cloud credentials. They are the keys that let an attacker create new accounts, change logging configuration, and spin up infrastructure inside a region that is supposed to be airtight against the public internet. Anyone who copied the importantAWStokens file during the six months it sat in public view could have walked straight into that environment.

The contractor’s pattern looked, to the people who later combed through the commit history, like nothing more sinister than convenience. Pushes happened with the cadence of someone synchronising files between a work laptop and a home machine through Git. To make that workflow possible without the secret-scanning alarms going off, the account owner had to manually disable GitHub’s default push protection, a setting that exists precisely to stop this kind of accident. The block was switched off, and the commits started.

CISA’s official statement frames the episode as contained. ‘There is no indication that any sensitive data was compromised as a result of this incident,’ the agency said, adding that it would put additional safeguards in place. That is a narrower claim than it reads at first. To know that no GovCloud account was abused over six months, an auditor has to walk every CloudTrail entry, every IAM role change and every workspace login in that window, and the agency has not said it has done that work — only that it sees no evidence so far. Independent observers also noted that the leaked AWS access keys remained valid for roughly two days after the repository was taken down, which is the gap during which any copy made earlier would still have worked.

This is the same agency that runs the federal Secret Sprawl programme, publishes guidance to other departments on credential hygiene, and has repeatedly warned private operators that exposing API tokens in source control is one of the most common entry points for ransomware crews. Its own Known Exploited Vulnerabilities catalogue, the one US contractors are legally required to track, treats unrotated cloud credentials as a high-severity finding. The Private-CISA repository met every criterion the agency uses when it tells everyone else they have failed.

Valadon, who works on GitGuardian’s research team, said the find was hard to read even after he confirmed it. ‘Passwords stored in plain text in a CSV, backups in Git, explicit commands to disable GitHub secrets detection,’ he wrote. ‘I honestly believed that it was all fake before analysing the content deeper. This is indeed the worst leak that I have witnessed in my career.’ GitGuardian alerted CISA on 15 May, and the repository was made private over the following weekend.

What CISA has not yet said publicly is whether the affected GovCloud accounts have been fully rotated, which internal systems on the password CSV have had their credentials changed, and whether the Department of Homeland Security’s Office of Inspector General will open a formal review. The contractor, reported to be working for the federal cybersecurity firm Nightwing, has not been named. The repository was created on 13 November 2025 and removed in mid-May 2026, which makes the public-exposure window six months and two days. The number the public is owed next is how many of those days the keys were actually used.

Tags: AWS GovCloud, CISA, credential leak, Cybersecurity, GitGuardian, GitHub, Guillaume Valadon, news, Nightwing