Back Blog.Gitguardian

How We Got a CISA GitHub Leak Taken Down in Under a Day

Blog.Gitguardian • May 19, 2026

On May 14, 2026, GitGuardian found what looked like leaked CISA secrets in a public GitHub repository named Private-CISA. It held 844 MB of data across the working tree and Git history. The working tree was 498 MB; the rest was Git history and objects.

The repository contained:

The exposed material provided a detailed view into cloud infrastructure, deployment workflows, software supply-chain tooling, and internal operational practices.

At first, we thought it was a hoax, given how suspicious the directory names ( Backup-April-2026/ , All Backups/ , LZ-Artifactory/ , Kubernetes-Important-Yaml-Files/ , ENTRA ID - SAML Certificates/ ...), file names ( external-secret-repo-creds.yaml , CAWS GitHub Token.txt , Important AWS Tokens.txt , AWS-Workspace-Firefox-Passwords.csv , Kube-Config.txt ...), and their contents (private keys, personal and professional GitHub tokens, AWS secrets, ...) seemed too good to be true.

Personal documents, hostnames, and the careful organization of the files changed our minds. The repository was a catalogue of unsafe practices: plain-text passwords, backups committed to Git, and explicit instructions to disable GitHub's secret scanning

Our research team reported the leak through the CERT/CC portal on May 14 at 4:14 PM CET and worked personal contacts in parallel to speed disclosure.

GitGuardian Public Monitoring surfaced the leak first. By May 13, our Good Samaritan program had already sent nine emails to the commit author.

Around 16:00 CET on May 15 we reached CISA directly. The repository went offline around 6:00 PM EST on May 15, 2026. Seeing the repository taken down so fast was a relief. Credit to CISA for moving fast — most of our disclosures take far longer, and some are never fixed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Contractor Exposes Sensitive AWS Credentials on Public GitHub A contractor for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) left a public GitHub repository named 'Private-CISA' exposed for six months, containing sensitive credentials including AWS GovCloud access keys and internal CISA system passwords. Discovered by GitGuardian researcher Guillaume Valadon on May 14, 2026, the repository included files such as 'importantAWStokens' and 'AWS-Workspace-Firefox-Passwords.csv', which detailed access to critical infrastructure. The repository was created on November 13, 2025, and remained accessible until it was taken down on May 15, 2026, after Valadon alerted CISA. Despite the quick response, some credentials remained valid for an additional 48 hours, raising concerns about potential exploitation. CISA has stated there is currently no evidence that sensitive data was compromised as a result of the incident. The leak highlights significant lapses in security practices, especially given CISA's role in advising on cybersecurity. 33 sources 69

Extracted Entities

How We Got a CISA GitHub Leak Taken Down in Under a Day

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)