CISA Credentials Exposed on Public GitHub Repo for 6 Months

A contractor for the Cybersecurity and Infrastructure Security Agency (CISA) inadvertently exposed highly sensitive administrative credentials and internal system details on a public GitHub repository for approximately six months, security researchers said. The exposure, which included plaintext passwords and keys granting high-level access to government cloud systems, was described by experts as one of the most serious government data leaks in recent years.

The repository, named "PrivateCISA," was created on November 13, 2025, and remained publicly accessible until it was taken offline over the past weekend after researchers notified the agency. It was maintained by an employee of Nightwing, a government contractor based in Dulles, Virginia. The repository contained files such as "importantAWStokens," which provided administrative access to at least three AWS GovCloud accounts used by CISA, and a CSV file listing plaintext usernames and passwords for dozens of internal agency systems.

Security researcher Guillaume Valadon of GitGuardian first identified the exposure. His firm scans public code repositories for leaked secrets. Valadon said he attempted to contact the repository...