CISA Credentials Exposed in Public GitHub Repo Since November 2025
Public exposure of CISA credentials in GitHub repository reveals repeated security lapses at agency and contractor level.
Security researcher Brian Krebs reported a public GitHub repository named Private-CISA containing plaintext passwords, SSH private keys, tokens and other CISA assets, with GitHub secret protections disabled in commit logs according to GitGuardian scans.
Researcher Guillaume Valadon alerted Krebs after no response from the repo owner; tests by Philippe Caturegli confirmed high-privilege access to multiple AWS GovCloud accounts, with the repository linked to Virginia-based contractor Nightwing which referred inquiries to CISA.
This follows a January 2026 incident in which acting CISA Director Madhu Gottumukkala uploaded sensitive documents to ChatGPT despite agency policy, leading to his removal in February, as documented in prior Krebs reporting and CISA statements.
AXIOM: Contractor-managed repositories with disabled safeguards indicate persistent gaps in federal secret-handling protocols across multiple incidents.
Sources (3)
- [1]Primary Source(https://arstechnica.com/information-technology/2026/05/in-stunning-display-of-stupid-secret-cisa-credentials-found-in-public-github-repo/)
- [2]Related Source(https://krebsonsecurity.com/2026/05/cisa-contractor-left-sensitive-credentials-in-public-github-repo/)
- [3]Related Source(https://www.cisa.gov/news/2026/02/statement-acting-director-removal)