"I quickly understood that the leak was bad and that time was running out. A national agency having 844 MB of production infrastructure material in a public GitHub repository for six months is as serious as a secrets leak gets." — Guillaume Valadon, GitGuardian researcher
Guillaume Valadon and GitGuardian's discovery
On May 14, GitGuardian researcher Guillaume Valadon discovered a public GitHub repository named "Private-CISA" that contained what he described as a catalogue of sensitive material. Valadon, who had just given a talk on Kubernetes secret leaks and previously spent nine years at France’s ANSSI, told The Register he initially thought the repository was a hoax because of the directory and file names, but concluded quickly that the exposure was real and urgent.
Contents of the "Private-CISA" repository
Valadon and GitGuardian reported the repository contained passwords, private keys, tokens, and other secrets in plain text. The Register relayed a list of exposed items that included tokens for CISA's internal JFrog Artifactory, Azure registry keys, AWS credentials, Kubernetes manifests, ArgoCD application files, Terraform infrastructure code, GitHub personal access tokens, and Entra ID SAML certificates. Files bore highly descriptive names such as "external-secret-repo-creds.yaml", "AWS-Workspace-Firefox-Passwords.csv", "CAWS GitHub Token.txt", and "Important AWS Tokens.txt", and directories included labels like "Backup-April-2026/" and "Kubernetes-Important-Yaml-Files/". Valadon also noted backups committed to Git and an "explicit" how-to guide for disabling GitHub's secret scanning.
CISA response and timeline
GitGuardian reported the exposed repository to CISA on May 14. According to Valadon, after reporting via the CERT/CC portal and receiving only an automated acknowledgement by the morning of May 15, he alerted security journalist Brian Krebs. By 6 p.m. Eastern that same day the repository had been taken offline. A CISA spokesperson told The Register the agency was aware of the report and was investigating, adding, "Currently, there is no indication that any sensitive data was compromised as a result of this incident." GitHub did not immediately respond to The Register's inquiry.
Attack paths and the risk of long-term persistence
Valadon warned that "each category of secret in the repository unlocks a specific attack path." The Register relayed his assessment that, stacked together, the exposed credentials and artifacts could enable a range of outcomes—from destructive attacks and ransomware extortion to quiet, long-term persistence within CISA's build and deployment pipeline. He identified the latter scenario—persistence inside the pipeline—as his greatest concern and cited the "mixed-identity" pattern in commits, where a CISA-issued contractor email and a personal Yahoo email appeared in the same commit history and the repository was created from a personal GitHub account. That mixing, Valadon said, creates a hard-to-cover surface where the worst leaks happen.
What this means for technologists, policymakers, and the public
- Technologists and security teams: The repository contained credentials and infrastructure as code (Terraform, Kubernetes manifests, ArgoCD files) that could allow attackers to move from initial access to build-system persistence. GitGuardian reported no awareness of exposed credentials being abused, and public GitHub events showed the repository had not been forked—factors that suggest, but do not prove, the material had not been widely harvested.
- Policymakers and agency leaders: The Register's coverage framed the exposure as damaging to the nation's top civilian cyber-defense agency at a fraught moment; the report noted CISA "hasn't had a permanent boss since Trump took office" and is confronting hundreds of millions of dollars in proposed budget cuts on top of deep staff and funding reductions last year. The incident highlights operational risk at an agency charged with helping others secure critical systems.
- The public and affected enterprises: While CISA said there is currently no indication of compromise, the presence of production infrastructure material, credentials, and certificates in a public repo for about six months raises questions about downstream exposure and the need for targeted credential rotation and pipeline validation.
Valadon credited CISA for taking the repository offline within a day of public escalation, noting that many responsible disclosures take longer or are never fixed. At the same time, he described the contents as demonstrating "a catalogue of unsafe practices"—plain-text passwords, committed backups, mixed identities in commits, and guidance on disabling secret scanning. The Register's reporting leaves a clear, concrete charge: the agency must complete its investigation, validate whether any of the exposed artifacts were used, rotate affected secrets, and shore up developer and pipeline hygiene to prevent recurrence.
