
CISA Credentials Exposed in Public GitHub Repo Since 2025
CISA had plaintext passwords, SSH private keys, tokens and other sensitive assets exposed in a public GitHub repo named Private-CISA since at least November 2025. The repo's administrator disabled GitHub's default secret protections, a contractor managed it, and testing confirmed high-privilege AWS GovCloud access was possible.
