The U.S. Cybersecurity and Infrastructure Security Agency had to build part of its incident response playbook while responding to a real security incident, after a contractor accidentally exposed sensitive credentials in a public GitHub repository.
Contractor Uploaded Sensitive Credentials to GitHub
The incident began with a contractor’s personal GitHub account.
Cybersecurity Dive reported that the contractor uploaded copies of a CISA build and deployment repository to a personal GitHub account to create cloud infrastructure autonomously.
TechCrunch reported that independent cybersecurity journalist Brian Krebs first revealed the exposed passwords after a researcher with GitGuardian found credentials stored in a publicly accessible GitHub repository.
The leaked material was highly sensitive. The repository included administrator and build credentials for CISA’s coding system, along with infrastructure-as-code data containing private access keys for services such as Amazon Web Services. The exposed credentials had to be revoked and replaced to prevent possible future abuse.
CISA Built a Playbook During the Emergency
The most striking admission came from CISA’s own postmortem. TechCrunch reported that CISA revealed its staff “had to spend time building” a playbook during the early stages of the incident.
Cybersecurity Dive reported that CISA had spent years urging organizations to create incident response playbooks, yet did not have one ready for a cloud security leak through GitHub.
That gap is notable because CISA is the federal agency responsible for helping defend government networks and critical infrastructure. A missing playbook does not mean the agency failed to respond, but it shows that even national cyber defenders can be forced to improvise when the exact incident scenario was not planned in advance.
No Mission Data Exposed, Agency Says
CISA said it moved quickly after learning of the leak. CISA began taking swift and comprehensive action, including taking the contractor’s GitHub repository offline and disabling the contractor’s access to CISA systems. CISA said no customer or mission data was exposed and thanked the researcher and reporter who helped bring the issue to light.
The agency also checked for abuse. CISA analyzed log files and determined there was no unauthorized use of the leaked credentials. CISA updated all passwords used in development environments to which the contractor had access, not only the passwords that were leaked.
Secrets Management and Reporting Channels Failed
CISA acknowledged that sensitive credentials should never have reached code repositories. CISA said “no repository should contain secrets,” yet secrets had made it into the agency’s private repositories. The agency also said that its channels for allowing security researchers to report potential incidents were “not well defined”.
That reporting failure mattered because the researcher reportedly struggled to alert the contractor before contacting Krebs. The leak became public partly because the researcher who discovered it could not figure out how to contact CISA and went to the press instead. CISA has since made changes to help researchers contact the agency more easily and quickly.
A Transparency Test for the Cyber Agency
The incident is awkward for CISA, but the public postmortem also signals an attempt at transparency. CISA’s unusual after-action report appeared aimed at reassuring Congress, industry partners and the public that its systems were secure and that improvements were underway.
The lesson is clear: even the agency that tells others to prepare for cyber incidents must keep improving its own response systems. CISA contained the GitHub leak, but the episode exposed deeper process gaps around contractor access, secrets management, researcher reporting and incident playbooks. In cybersecurity, the response plan cannot be something an organization builds after the alarm has already sounded.
