On May 14, GitGuardian found a public GitHub repository called "Private-CISA" — 844 MB of plain-text passwords, AWS tokens, and Entra ID SAML certificates belonging to CISA, exposed since November 2025. Some credentials were still valid. CISA pulled it offline within 26 hours.

GitGuardian Blog provides insights, tutorials, and updates on secrets management, code security, and developer best practices. Covering topics such as credential leaks, code scanning, and secure development workflows, GitGuardian Blog offers resources for developers, security professionals, and DevOps teams. Readers can learn about detecting and preventing secrets exposure, securing code repositories, and implementing secure coding practices through GitGuardian's articles and security guides.

GitGuardian

GitGuardian discovered a public GitHub repository named 'Private-CISA' on May 14, 2026, containing 844 MB of sensitive CISA data including plain-text passwords, AWS tokens, Kubernetes configs, ArgoCD files, and Entra ID SAML certificates — some credentials still active. The data had been exposed since November 2025. GitGuardian's Good Samaritan program had already sent nine emails to the commit author before the formal report. After filing through CERT/CC and leveraging personal contacts including Brian Krebs, CISA was reached directly and took the repository offline within 26 hours of formal disclosure. The incident highlights dangerous practices: plain-text secrets in Git, backups committed to repositories, and explicit instructions to disable GitHub's secret scanning.

How We Got a CISA GitHub Leak Taken Down in Under a Day