Till this previous weekend, a contractor for the Cybersecurity & Infrastructure Safety Company (CISA) maintained a public GitHub repository that uncovered credentials to a number of extremely privileged AWS GovCloud accounts and a lot of inner CISA programs. Safety consultants mentioned the general public archive included recordsdata detailing how CISA builds, exams and deploys software program internally, and that it represents one of the vital egregious authorities information leaks in current historical past.
On Could 15, KrebsOnSecurity heard from Guillaume Valadon, a researcher with the safety agency GitGuardian. Valadon’s firm consistently scans public code repositories at GitHub and elsewhere for uncovered secrets and techniques, robotically alerting the offending accounts of any obvious delicate information exposures. Valadon mentioned he reached out as a result of the proprietor on this case wasn’t responding and the data uncovered was extremely delicate.
A redacted screenshot of the now-defunct “Personal CISA” repository maintained by a CISA contractor.
The GitHub repository that Valadon flagged was named “Personal-CISA,” and it harbored an enormous variety of inner CISA/DHS credentials and recordsdata, together with cloud keys, tokens, plaintext passwords, logs and different delicate CISA property.
Valadon mentioned the uncovered CISA credentials characterize a textbook instance of poor safety hygiene, noting that the commit logs within the offending GitHub account present that the CISA administrator disabled the default setting in GitHub that blocks customers from publishing SSH keys or different secrets and techniques in public code repositories.
“Passwords saved in plain textual content in a csv, backups in git, express instructions to disable GitHub secrets and techniques detection function,” Valadon wrote in an electronic mail. “I truthfully believed that it was all faux earlier than analyzing the content material deeper. That is certainly the worst leak that I’ve witnessed in my profession. It’s clearly a person’s mistake, however I consider that it’d reveal inner practices.”
One of many uncovered recordsdata, titled “importantAWStokens,” included the executive credentials to 3 Amazon AWS GovCloud servers. One other file uncovered of their public GitHub repository — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of inner CISA programs. In accordance with Caturegli, these programs included one known as “LZ-DSO,” which seems brief for “Touchdown Zone DevSecOps,” the company’s safe code growth atmosphere.
Philippe Caturegli, founding father of the safety consultancy Seralys, mentioned he examined the AWS keys solely to see whether or not they have been nonetheless legitimate and to find out which inner programs the uncovered accounts may entry. Caturegli mentioned the GitHub account that uncovered the CISA secrets and techniques reveals a sample according to a person operator utilizing the repository as a working scratchpad or synchronization mechanism slightly than a curated venture repository.
“The usage of each a CISA-associated electronic mail handle and a private electronic mail handle suggests the repository could have been used throughout in a different way configured environments,” Caturegli noticed. “The out there Git metadata alone doesn’t show which endpoint or machine was used.”
The Personal CISA GitHub repo uncovered dozens of plaintext credentials for vital CISA GovCloud sources.
Caturegli mentioned he validated that the uncovered credentials may authenticate to 3 AWS GovCloud accounts at a excessive privilege degree. He mentioned the archive additionally consists of plain textual content credentials to CISA’s inner “artifactory” — basically a repository of all of the code packages they’re utilizing to construct software program — and that this is able to characterize a juicy goal for malicious attackers on the lookout for methods to take care of a persistent foothold in CISA programs.
“That will be a chief place to maneuver laterally,” he mentioned. “Backdoor in some software program packages, and each time they construct one thing new they deploy your backdoor left and proper.”
In response to questions, a spokesperson for CISA mentioned the company is conscious of the reported publicity and is constant to analyze the state of affairs.
“At present, there is no such thing as a indication that any delicate information was compromised on account of this incident,” the CISA spokesperson wrote. “Whereas we maintain our crew members to the very best requirements of integrity and operational consciousness, we’re working to make sure extra safeguards are carried out to forestall future occurrences.”
A overview of the GitHub account and its uncovered passwords present the “Personal CISA” repository was maintained by an worker of Nightwing, a authorities contractor primarily based in Dulles, Va. Nightwing declined to remark, directing inquiries to CISA.
CISA has not responded to questions concerning the potential length of the info publicity, however Caturegli mentioned the Personal CISA repository was created on November 13, 2025. The contractor’s GitHub account was created again in September 2018.
The GitHub account that included the Personal CISA repo was taken offline shortly after each KrebsOnSecurity and Seralys notified CISA concerning the publicity. However Caturegli mentioned the uncovered AWS keys inexplicably continued to stay legitimate for an additional 48 hours.
CISA is presently working with solely a fraction of its regular price range and staffing ranges. The company has misplaced practically a 3rd of its workforce for the reason that starting of the second Trump administration, which compelled a collection of early retirements, buyouts, and resignations throughout the company’s varied divisions.
The now-defunct Personal CISA repo confirmed the contractor additionally used easily-guessed passwords for plenty of inner sources; for instance, lots of the credentials used a password consisting of every platform’s identify adopted by the present 12 months. Caturegli mentioned such practices would represent a critical safety menace for any group even when these credentials have been by no means uncovered externally, noting that menace actors typically use key credentials uncovered on the inner community to develop their attain after establishing preliminary entry to a focused system.
“What I think occurred is [the CISA contractor] was utilizing this GitHub to synchronize recordsdata between a piece laptop computer and a house laptop, as a result of he has frequently dedicated to this repo since November 2025,” Caturegli mentioned. “This could be an embarrassing leak for any firm, nevertheless it’s much more so on this case as a result of it’s CISA.”
