CISA Contractor Leaves Sensitive AWS Credentials and Passwords in Public GitHub Repository for Six Months

A contractor working for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) inadvertently left highly sensitive internal credentials exposed on a public GitHub repository [1]. The exposed data included access keys for AWS GovCloud and plaintext passwords, which remained accessible to the public for six months before the error was identified and secured [2]. AWS GovCloud is specifically designed to host sensitive government data and workloads, making the exposure of its access keys a significant security event that required immediate mitigation [3].[1][2][3]

The presence of plaintext passwords further compounded the risk, potentially offering unauthorized actors direct pathways into secure CISA environments [4]. However, the eventual discovery of the breach allowed CISA and its contractor to swiftly secure the repository, revoke the compromised credentials, and audit the affected systems [5]. This rapid response neutralized the immediate threat and prevented what could have been a catastrophic compromise of national cybersecurity infrastructure [6].[4][5][6]

This incident serves as a vital stress test for government security protocols, prompting immediate reviews of vendor security practices [7]. By transparently addressing the exposure, CISA provides a valuable case study for private enterprises and other government bodies on the importance of continuous monitoring [1]. It reinforces the cybersecurity community's shift toward assuming breach and focusing on resilience, ensuring that single points of failure—like a misplaced GitHub commit—do not compromise entire networks [3].[1][3][7]

Supply chain vulnerabilities and contractor errors remain one of the most persistent challenges in modern cybersecurity [4]. The resolution of this exposure highlights the critical need for automated credential scanning tools that can block developers from pushing sensitive secrets to public repositories [5]. Moving forward, the incident is expected to accelerate the adoption of stricter data handling policies and zero-trust frameworks across federal agencies and their third-party partners [2].[2][4][5]