[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6fcyjbtcFEPXOWUwJoSUkawYPkuVM-Nc_1TtWf1jZOw":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"1fa5feb3-1541-4c00-bad9-283ca31b1423","Lessons Learned from CISA’s Recent GitHub Leak","lessons-learned-from-cisa-s-recent-github-leak-5c213d","The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency's initial response provide important lessons that all security teams should absorb.","A CISA contractor inadvertently exposed sensitive internal credentials, including AWS Govcloud keys and plaintext passwords, in a public GitHub repository for nearly six months. The leak was only discovered after a security firm and a reporter intervened. CISA's postmortem highlighted significant delays in rotating compromised credentials and issues with its incident notification channels, emphasizing the need for better key management and clearer reporting processes.","CISA contractor exposed AWS Govcloud keys and internal credentials on GitHub for six months.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F07\u002Flessons-learned-from-cisas-recent-github-leak\u002F","https:\u002F\u002Fkrebsonsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FCISA-logo.png","2026-07-13T15:03:28+00:00","2026-07-13T16:00:08.88611+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"GitHub","vendor",{"name":21,"type":19},"Amazon AWS",{"name":23,"type":24},"AWS Govcloud","product",{"name":26,"type":24},"AWS-Workspace",{"name":28,"type":19},"GitGuardian","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":29,"icon":31,"name":32,"slug":33},null,"Breaches","breaches",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,28],{"controls":55,"vendors":132},[56,84,106],{"slug":57,"name":58,"problem":59,"products":60},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[61,69,76],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":70,"vendor_name":28,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"gitguardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":85,"name":86,"problem":87,"products":88},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[89,97,98],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"slug":107,"name":108,"problem":109,"products":110},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":128,"product_name":129,"url":130,"description":131},"unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",[133],{"slug":70,"name":28,"logo_path":71,"roles":134},[135],"reported_by",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":153},"cisa-contractor-exposes-aws-keys-and-passwords-on-public-github-for-six-months","CISA Contractor Exposes AWS Keys and Passwords on Public GitHub for Six Months","A CISA contractor accidentally committed sensitive credentials — including AWS GovCloud keys and plaintext passwords — to a public GitHub repository, where they remained exposed for nearly six months. The breach was not discovered internally; it took intervention from an external security firm and a journalist to surface the issue, revealing a critical gap in both secret detection tooling and monitoring practices. Once discovered, CISA's response was hampered by slow credential rotation and unclear incident notification channels, compounding the risk window. This incident underscores that human error in handling secrets is inevitable, making automated detection, rapid response playbooks, and robust key management controls essential — even for the organizations responsible for defending others.",[141,142,143,144,145,146,147,148,149,150,151,152],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 17: Incident Response Management","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 IR-6: Incident Reporting","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF DE.CM-3: Personnel activity monitoring","NIST CSF RS.CO-2: Incidents reported per established criteria","ITIL: Incident Management — escalation and notification procedures","GDPR Article 32: Security of processing (appropriate technical measures)","GDPR Article 33: Notification of a personal data breach within 72 hours",{}]