# CISA Contractor's GitHub Repository Exposed AWS GovCloud Keys, Internal Credentials in "Worst Leak" of the Decade


A public GitHub repository maintained by a Cybersecurity & Infrastructure Security Agency contractor exposed highly privileged AWS GovCloud credentials, plaintext passwords, and internal deployment files until this past weekend—in what security researchers are calling one of the most egregious government data leaks in recent history.


The now-defunct "Private-CISA" repository contained administrative access tokens, SSH keys, cloud credentials, CSV files of plaintext passwords, and detailed documentation of how CISA builds, tests, and deploys software internally. Security researcher Guillaume Valadon of GitGuardian discovered the exposure and reached out to CISA after attempts to contact the repository owner went unanswered.


"Passwords stored in plain text in a CSV, backups in git, explicit commands to disable GitHub secrets detection feature," Valadon wrote when flagging the issue. "I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I've witnessed in my career."


## The Threat: What Was Exposed


The compromised repository included multiple categories of sensitive assets:


AWS Credentials: A file titled "importantAWStokens" contained administrative credentials to three Amazon AWS GovCloud accounts—the infrastructure the federal government uses for classified and sensitive workloads.


Internal System Passwords: An "AWS-Workspace-Firefox-Passwords.csv" file listed plaintext usernames and passwords for dozens of internal CISA systems, including access to LZ-DSO (Landing Zone DevSecOps), the agency's secure code development environment where developers build and test security-critical software.


Artifact Repository Credentials: The exposed files included plain text credentials to CISA's internal "artifactory"—essentially a repository containing all the code packages and dependencies the agency uses to build its software. Philippe Caturegli, founder of the security consultancy Seralys, called this "a prime place to move laterally," noting that compromised artifacts could serve as a vector for backdooring software packages deployed across CISA infrastructure.


Operational Documentation: Beyond credentials, the repository contained logs, configuration files, and deployment procedures that documented CISA's internal practices and systems architecture.


Caturegli confirmed through testing that the exposed AWS credentials could authenticate at high privilege levels to the affected GovCloud accounts. The implications are severe: an attacker with these credentials could provision new resources, access stored data, modify configurations, or establish persistence mechanisms within CISA's cloud infrastructure.


## Background and Context: From Scratchpad to Disaster


Analysis of the repository's structure and git history suggests this was not a deliberate data dump but rather a cautionary tale of misused development tools. According to Caturegli, the GitHub account exhibited patterns consistent with an individual using the repository as a working scratchpad or synchronization mechanism rather than as a curated project repository.


The repository was tied to both a CISA-associated email address and a personal email address, indicating it was likely used across different development environments and devices. This type of "sync across machines" use case is a common anti-pattern—developers sometimes treat public repositories as informal storage for scripts, configurations, or temporary work that should never be persisted in version control.


The commit history reveals an even more alarming detail: the repository owner explicitly disabled GitHub's built-in secrets detection feature—the default setting that alerts users when they're about to commit SSH keys, API tokens, or other sensitive strings. This wasn't an accidental oversight but an intentional circumvention of a platform-level protection mechanism.


"The explicit disabling of GitHub's secrets detection is particularly concerning," security experts noted. It suggests either a fundamental misunderstanding of the feature's purpose or a deliberate choice to bypass security controls—both represent serious security hygiene failures.


## Technical Details: Why This Matters


AWS GovCloud Significance: AWS GovCloud is a specialized cloud region designed to meet strict compliance requirements (FedRAMP, HIPAA, etc.) for U.S. government and highly regulated organizations. Access to GovCloud administrative credentials represents access to the highest levels of federal cloud infrastructure.


The Artifactory Attack Vector: The exposed artifactory credentials are particularly dangerous because they allow attackers to inject malicious code into software packages that CISA uses internally. A compromised package could spread compromise across multiple internal systems with each deployment. This mirrors the SolarWinds supply chain attack of 2020, where attackers backdoored a widely-used software package.


Plaintext Password Storage: Modern security practices mandate that passwords should never be stored in plain text anywhere—especially not in version control and especially not for highly privileged accounts. Even if archived, they should be encrypted at rest.


## Implications: Risk Assessment and Damage Potential


The exposure window is unknown. The repository was discovered on May 15, but it's unclear how long it had been public. During any period of exposure, the following risks materialized:


  • Unauthorized Cloud Access: Any actor with the AWS keys could provision resources, access data, or launch denial-of-service attacks against CISA infrastructure.
  • Lateral Movement: With credentials to the artifactory and internal systems like LZ-DSO, attackers could move laterally through CISA's development environment, potentially compromising the software CISA distributes to other federal agencies and critical infrastructure operators.
  • Persistence: Attackers could use the credentials to create backdoor accounts, configure API keys, or deploy long-term persistence mechanisms before credentials were rotated.
  • Intelligence Gathering: The exposed files provided operational intelligence about how CISA builds and deploys software—information valuable to adversaries seeking to find or exploit vulnerabilities in CISA systems or its software distribution pipeline.

    • The damage extends beyond CISA itself. CISA distributes critical security guidance, vulnerability advisories, and software tools to thousands of federal agencies, critical infrastructure operators, and private sector organizations. Compromise of CISA's internal systems could undermine the integrity of these distributions.


    ## Recommendations: Immediate and Systemic


    Immediate Actions:

  • CISA has presumably rotated all exposed credentials, but this should have been done immediately upon discovery.
  • All affected AWS GovCloud accounts should be audited for unauthorized activity and resource creation.
  • Artifact repository integrity should be verified; any packages built or deployed since the exposure should be reviewed for tampering.
  • Code repositories and deployment pipelines should be scanned for any backdoored commits.

    • Systemic Changes:

  • Enforce Secrets Detection: GitHub's secrets detection should not be a "nice-to-have" default; it should be enforced at the organization level and in pre-commit hooks. Contributors should be unable to push commits containing exposed patterns.
  • Credential Management: Organizations should transition away from plaintext credentials in files entirely. Use secret managers (AWS Secrets Manager, HashiCorp Vault, etc.), environment variables, or short-lived credentials with automatic rotation.
  • Git Repository Policies: Public repositories should be explicitly prohibited for any operational work. Internal work should be confined to private repositories with access controls. Better yet, use separate tools (artifact repositories, secret managers, deployment platforms) for each class of data.
  • Access Control Reviews: Developers should not have administrative-level cloud credentials. Use role-based access control and assume-role patterns to minimize the blast radius of any individual credential compromise.
  • Security Training: This incident reflects not just a technical failure but a cultural one. Organizations must invest in security training that explains why these practices matter, not just what the rules are.

    • ## HackWire Analysis


    This leak represents a perfect storm of security failures—not malice, but a cascade of poor decisions that individually might be forgivable but collectively created an open door to critical federal infrastructure.


    What stands out is not the exposure itself but the *pattern*: a developer treating a public code repository as personal infrastructure. This is shockingly common. Security researchers regularly find exposed credentials in public repositories because developers don't think of GitHub as "production"—it's a development tool. The boundary between scratchpad and repository blurs when you're working across multiple machines.


    The explicit disabling of GitHub's secrets detection is the detail that crystallizes the problem. This wasn't negligence; it was an active choice to circumvent a security control. Why? Possibly because the developer found the alerts annoying and didn't understand their purpose. Possibly because they didn't realize the repository was public. Possibly both.


    The timing is relevant: as government agencies increasingly shift to cloud infrastructure and adopt DevOps practices, they're adopting not just the technology but its culture and tooling. That's valuable. But it also means adopting the security failures of the broader tech industry—the assumption that development infrastructure is somehow less critical than production, the convenience-over-security mindset, the technical debt that accumulates when tooling is chosen for speed rather than safety.


    For defenders, this is instructive: this incident wasn't caused by a sophisticated attacker or a zero-day vulnerability. It was caused by a developer and a GitHub repository. The highest-value attacks often aren't the most complex ones. They're the ones that exploit the gap between what organizations think they're protecting and what they're actually exposing.


    CISA's own advice (whether the agency realized it or not) applies here: assume breach. The consequences could have been severe. Now organizations should audit their own repositories, enforce secrets detection, and ask uncomfortable questions about what else might be accidentally public. — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Policy](https://www.hackwire.news/category/policy) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)