CISA Postmortem Reveals Six‑Month Leak of AWS GovCloud Credentials
Implement continuous secret scanning and improve reporting channels to reduce exposure time.
Set up automated secret scanning for public repositories and enforce a clear reporting process for internal secrets.
Summary
The Cybersecurity and Infrastructure Security Agency released a postmortem after a contractor published 844 MB of sensitive CISA data, including AWS GovCloud keys, in a public GitHub repository for almost six months. GitGuardian alerted CISA on May 15, 2026, but it took more than 48 hours to invalidate the exposed keys and other secrets, revealing gaps in CISA’s key‑rotation and incident‑response processes. The report notes that CISA ignored nine automated alerts about the exposed credentials before the GitGuardian notification, and that the lack of clear reporting channels caused the researcher to try multiple avenues, including emailing the contractor and using the vulnerability‑disclosure platform. CISA’s postmortem stresses the importance of mature key‑management capabilities, continuous secret scanning, and publishing reporting instructions in multiple prominent locations, such as a security.txt file.
The agency rotated all secrets, created an action plan to improve developer‑secret management, and confirmed that no customer or mission data was exposed or used outside CISA’s environments. The incident highlighted that a public repository can remain exposed for months if continuous monitoring is not in place, and that internal scanning could have caught the plaintext passwords earlier. CISA’s playbook lacked guidance for incidents involving GitHub or other cloud services, underscoring the need for specialized incident‑response procedures. The postmortem is the first public advocacy by a national agency for secrets scanning and simplified researcher communication, setting a new standard for incident response.
Key changes
- CISA leaked 844 MB of sensitive data, including AWS GovCloud keys, in a public GitHub repository for almost six months.
- It took more than 48 hours to invalidate the exposed keys, revealing gaps in key‑rotation and incident‑response processes.
- CISA ignored nine automated alerts about the exposed credentials before GitGuardian’s notification.
- The lack of clear reporting channels caused the researcher to try multiple avenues, including emailing the contractor and using the vulnerability‑disclosure platform.
- CISA’s postmortem stresses the need for mature key‑management, continuous secret scanning, and publishing reporting instructions in multiple prominent locations such as a security.txt file.
- The agency rotated all secrets, created an action plan to improve developer‑secret management, and confirmed no customer or mission data was exposed or used outside CISA’s environments.
- The incident highlighted that a public repository can remain exposed for months if continuous monitoring is not in place, and that internal scanning could have caught the plaintext passwords earlier.
- The postmortem is the first public advocacy by a national agency for secrets scanning and simplified researcher communication.