Skip to content

CISA Admin Leaked AWS GovCloud Keys on GitHub

8.5 relevance
Score Breakdown
technical depth
8
novelty
7
actionability
6
community
9
strategic
8
personal
8

Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.

AWS GovCloud key leak, high technical detail and security relevance.

2026-05-19 Cloud krebsonsecurity.com
The Private CISA GitHub repo exposed dozens of plaintext credentials to important CISA GovCloud resources. The filenames include AWS-Workspace-Bookmarks-April-6-2026.html, AWS-Workspace-Firefox-Passwords.csv, Important AWS Tokens.txt, kube-config.txt, etc.
Summary

A CISA contractor's public "Private-CISA" GitHub repo exposed admin keys to three AWS GovCloud accounts, plaintext passwords for dozens of internal systems (including the agency's software artifactory), and detailed build processes — after the admin disabled GitHub's automated secret detection. GitGuardian discovered the leak, which security experts describe as one of the worst government data breaches; CISA is investigating.

Key Takeaways
  • Enforce pre-commit secret scanning via tools like GitGuardian or ggshield, disable the ability to override GitHub's push protection, and regularly audit public repositories in your organization for exposed credentials.
Why it matters

For cloud and platform engineers, this underscores the critical need for automated secret scanning, mandatory pre-commit detection hooks, and strict credential lifecycle policies to prevent a single misconfigured repo from exposing GovCloud infrastructure, internal CI/CD pipelines, and artifact repositories.