The U.S. cyber agency built to prevent federal breaches is now under congressional pressure over its own exposed secrets.
Lawmakers in both chambers are demanding answers from CISA after a contractor allegedly published AWS GovCloud keys and other agency credentials to a public GitHub account called “Private-CISA,” according to Krebs on Security. The issue is not fully contained: Krebs reported that CISA was still working to invalidate and replace leaked credentials more than a week after being notified by GitGuardian.
Congress Presses CISA After Contractor Exposes AWS GovCloud Keys on GitHub
CISA’s public line is narrow. In a written statement, the agency said “there is no indication that any sensitive data was compromised as a result of the incident.”
Congress is not treating that as the end of the matter.
On May 19, Sen. Maggie Hassan (D-NH) sent a letter to CISA Acting Director Nick Andersen, saying the leak raised serious questions about the agency’s internal controls. Her concern is sharpened by CISA’s role: it is the federal agency responsible for helping defend government networks and critical infrastructure.
“This reporting raises serious concerns regarding CISA’s internal policies and procedures at a time of significant cybersecurity threats against U.S. critical infrastructure,” Sen. Hassan wrote.
The House followed with its own pressure. Rep. Bennie Thompson (D-MS), ranking member on the House Homeland Security Committee, sent a May 19 letter co-signed by Rep. Delia Ramirez (D-Ill), ranking member of the Subcommittee on Cybersecurity and Infrastructure Protection.
“We are concerned that this incident reflects a diminished security culture and/or an inability for CISA to adequately manage its contract support,” Thompson wrote. “It’s no secret that our adversaries — like China, Russia, and Iran — seek to gain access to and persistence on federal networks. The files contained in the ‘Private-CISA’ repository provided the information, access, and roadmap to do just that.”
The reported facts are blunt. On May 18, KrebsOnSecurity said a CISA contractor with administrative access to the agency’s code development platform created the public GitHub profile “Private-CISA.” The account included plaintext credentials to dozens of internal CISA systems.
Experts who reviewed the repository said its commit logs showed the contractor disabled GitHub’s built-in protection against publishing sensitive credentials in public repos.
That detail matters. This was not merely a file left in the wrong place. If the review is accurate, a guardrail meant to stop exactly this kind of secret exposure was turned off.
Leaked CISA Credentials Raise Fresh Questions About Federal Cybersecurity Controls
The central risk is access. Exposed cloud keys, private keys, and application credentials can open paths into internal systems, code repositories, deployment workflows, and security tooling if they remain live.
Krebs reported that experts who reviewed the now-defunct Private-CISA archive said it was originally created in November 2025. They described it as consistent with a single operator using the repository as a working scratchpad or synchronization mechanism, rather than a curated software project.
That pattern points to a familiar security failure: sensitive operational material moved into a place designed for collaboration and visibility.
For CISA, the reputational damage is unusually sharp. The agency tells other federal bodies and critical infrastructure operators how to manage cyber risk. Here, the issue is whether CISA’s own contractor access, GitHub controls, and secrets management practices matched the standards it expects others to follow.
A useful before-and-after view:
- Expected control: Sensitive credentials stay out of public repositories, with automated scanning and enforced policy blocks.
- Reported reality: A contractor allegedly published plaintext credentials and disabled GitHub’s protection against secret publication.
- Expected response: Immediate revocation, rotation, and access review after discovery.
- Reported reality: Krebs said CISA was still working to invalidate and replace many exposed keys and secrets more than a week after GitGuardian first notified the agency.
- Expected accountability: Clear timeline, affected systems list, and exploitation assessment.
- Current gap: CISA has not answered questions about how long the data was exposed.
The contractor angle will likely dominate the next round of scrutiny. Lawmakers are not only asking whether the leaked keys were abused. They are asking whether CISA had enough control over people working inside its own development environment.
For readers tracking how exposed credentials turn into broader compromise paths, MLXIO has covered related credential-risk mechanics in Free Steam Game Crashes but Secretly Steals Your Credentials. We also recently examined privileged access fallout in Microsoft Defender Zero-Days Hand Hackers SYSTEM Keys, a separate case that underscores why key material and elevated permissions remain high-value targets.
A GitHub App Key Turned the Leak Into a Code-Supply-Chain Problem
The most alarming technical claim in the Krebs report came from Dylan Ayrey, creator of TruffleHog, an open-source tool for finding private keys and secrets in code hosted on GitHub and other platforms.
Ayrey told Krebs that, as of May 20, CISA still had not invalidated an exposed RSA private key tied to a GitHub app owned by the CISA enterprise account. That app was installed on the CISA-IT GitHub organization with full access to all code repositories.
“An attacker with this key can read source code from every repository in the CISA-IT organization, including private repos, register rogue self-hosted runners to hijack CI/CD pipelines and access repository secrets, and modify repository admin settings including branch protection rules, webhooks, and deploy keys,” Ayrey told KrebsOnSecurity.
CI/CD refers to the automated build, test, and deployment pipeline for software. In this case, the concern is not only that secrets were visible. It is that a key may have allowed manipulation of the systems that build and ship code.
Krebs said it notified CISA about Ayrey’s findings on May 20. CISA acknowledged receiving the report but did not respond to follow-up inquiries. Ayrey later said CISA appeared to have invalidated that RSA private key sometime after the notification.
He also said CISA still had not rotated leaked credentials tied to other critical security technologies deployed across the agency’s technology portfolio. Krebs said it is not naming those technologies publicly for now.
That leaves CISA managing two problems at once: containment and confidence. The first is technical. The second is political.
CISA Faces Deadlines on Breach Timeline, Scope, and Credential Revocation
The next phase will turn on evidence, not assurances.
Investigators and lawmakers will want the full exposure timeline: when Private-CISA went public, when the first sensitive credential appeared, when CISA learned of the repository, and when each exposed key was revoked. They will also want to know whether any unauthorized API calls, GitHub actions, repository access, or configuration changes occurred before revocation.
Ayrey warned that GitHub’s public activity feed changes the risk calculus. His company Truffle Security monitors that feed for exposed secrets. So do attackers, he said.
“We monitor that firehose of data for keys, and we have tools to try to figure out whose they are,” he said. “We have evidence attackers monitor that firehose as well. Anyone monitoring GitHub events could be sitting on this information.”
That is the containment nightmare. Even if the original repository disappears, secrets may have been copied, cached, mirrored, or acted on before defenders moved.
Analysis: The hardest question for CISA is not whether a contractor made a severe mistake. The harder question is whether the agency can prove the mistake did not become an intrusion. That requires logs, rotation records, repository audits, contractor access reviews, and a credible explanation of why GitHub protections could be bypassed or disabled.
The near-term watch items are concrete: CISA’s public timeline, confirmation that all exposed credentials have been invalidated, any evidence of exploitation, and whether Hassan, Thompson, and Ramirez escalate from letters to hearings or a broader review of contractor access controls. Until those answers arrive, CISA’s statement that there is no indication sensitive data was compromised remains only one part of a much larger unresolved breach story.
Impact Analysis
- CISA is the agency tasked with defending federal networks, so leaked credentials raise trust and oversight concerns.
- Congressional scrutiny suggests lawmakers may push for stronger controls over contractors and cloud credentials.
- The incident highlights how exposed secrets on public code repositories can create national security risks even without confirmed data compromise.
