‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub

vibe code go brrrrrrr

EDIT: wow it's far worse, it was a single contractor that decided that his convenience was above any and all security recommendations ever written. Pure. Genius!

Six months of exposure.

There is zero chance that the CISA systems have not been comprehensively breeched by every foreign adversary.

Good thing Trump cut 1/4 of their workforce last year. It's really paying dividends for Putin.

jesus christ

This regime has caused so much damage to our national security, much of which we won't discover for years or decades. The Russians and Chinese (and literally anyone else) are probably fully infiltrated into our entire system in every aspect. SO fucking incompetent and corrupt.

Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.

But wait

Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.

“Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature,” Valadon wrote in an email. “I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career. It is obviously an individual’s mistake, but I believe that it might reveal internal practices.”

One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers.

This is shameful incompetence. Just head-rolling abysmal incompetence. These are the people they hired, for all you 1337 hax0rz currently looking.

Here's a link to the Krebs on Security article that Gizmodo used as a source: https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

GitHub gets autoscanned by thousands of malicious actors for keys and credentials on every commit, including the comments lol.

The fact that CISA themselves never saw an automated breach attempt only minutes after pushing to github is the more interesting story here.

Either the contractor is so incompetent that they didn't have any logging set up and the breach went completely unnoticed for 6 months.

Or this really is some fat honeypot that they won't admit is a honeypot because they've been using it to watch or bait APTs.

Currently, there is no indication that any sensitive data was compromised as a result of this incident

This is literally impossible unless it really was a honeypot. You can demo this yourself in real time. Make a throwaway cloud account on your favorite provider, commit the cloud auth token into a repo, and you will see an automated bot login within minutes.

Commiting any secrets to a public repo should just be considered auto compromised because of how potent it is.

That stuff ususlly gets exposed via poor CI/CD permissions where credentials are required, but straight up file commit is like publicly announcing exactly where you left your house keys lol.

Imagine fucking up so bad security researchers think it must be an obvious honey pot until they see what the credentials give access to

This isnt a leak. This is incompetency.

Why are people acting surprised? This is exactly what DOGE intended to do.

"Leak"

Is this the same cybersecurity agency that fired all its professionals to replace them with sycophants?

Its dumb shit like this that reassures me that AI will definitely take over cyber security jobs and make shit even LESS secure than everything already is.

Passwords were stored as plain text in a public GitHub repository.

Governments and corporations are made up of people, and when people see other people treated like garbage, they tend to become less diligent in their own duties, and loyalty is thrown out the window. Revenge is never off the table.

Also, even if you get rid of everybody so that no witnesses of your injustice remain, you've filled those positions with neophytes, who are incompetent for quite some time (at least).

that's the notorious "double whammy catch-22 fuck around find out" phenomenon, a TRIPLE THREAT

Wow. Wowowowowowowowow. Wow.

that's, uh... that's bad, right?

OMG

I'm surprised whatever software the keys were for didn't detect this and deactivate the keys. Discord did this automatically when I pushed a file to github that had a bot login token in it. Apparently Discord constantly scans github for such things, or maybe github does and sends Discord a msg, I dunno. But it was amazingly fast, like within 2 minutes.

U.S. Cybersecurity Agency == Chat_gipity_techno_turds or short version doge_after_birth... like top jorb in the land man...or should be. Always running from or running to. Constipation or diarrhea

Fast. Cheap. Good.

At best, pick 2.

This applies to code and coders as well, despite management's inability to comprehend reality.

Defund DHS.

...but remember, everything needs to be written in memory safe languages to stop security breaches.

And, when mainstream media periodically interviews republican congressmen who happen to be opposed to the Trump admin’s latest corruption/idiocy, why the hell do they never ask “Since you’re against these illegal/irresponsible actions… what the flying F are you gonna do about it?”

huh, so they've never used npm?

Honeypot?

Passwords were a mistake.

What are the odds this was AI related vs some underpaid intern