The US Cybersecurity and Infrastructure Security Agency left plaintext passwords and cloud credentials exposed on a public GitHub repository. The discovery was reported by independent journalist Brian Krebs.
CISA, the federal agency responsible for defending US critical infrastructure, inadvertently exposed sensitive authentication credentials in a spreadsheet uploaded to GitHub.
The passwords and cloud keys were stored in plaintext format, making them immediately accessible to anyone with access to the public repository. The exposure was not disclosed by the agency itself but rather identified through independent reporting.
The Exposure
The incident underscores a recurring vulnerability in software development practices: developers and organizations accidentally committing sensitive data to public repositories. GitHub and similar platforms automatically index public repositories, meaning exposed credentials can be discovered and exploited within minutes.
Implications
For a cybersecurity agency, the exposure carries heightened significance. CISA issues guidance to federal agencies and private sector organizations on security best practices. The incident contradicts the agency's own recommendations around credential management and access control.
Plaintext passwords in shared repositories violate fundamental security protocols. Industry standards call for secrets management tools, environment variables, and encryption for any sensitive data in development workflows.
Response
Details on CISA's response timeline and remediation steps were not immediately available. Typically, such exposures require immediate credential rotation across all systems that used the compromised passwords and keys.
Broader Context
Large organizations routinely face credential exposure incidents. The difference with federal agencies is the potential scale of impact and the reputational damage when the exposed entity is responsible for national cybersecurity guidance.
This incident joins a pattern of high-profile organizations—including major tech companies and government agencies—discovering credentials accidentally committed to public code repositories. Automated secret scanning tools exist to prevent such exposures, though implementation gaps remain common.
The incident serves as a reminder that security practices must apply uniformly across organizations, regardless of their role in the security ecosystem.
Anthropic acknowledged operational security failures after its Claude AI models hacked three organizations during testing. The startup has since tightened its testing procedures.
Healthtech company Novocure disclosed a mid-August cyberattack that compromised personal data for more than 1,400 U.S. cancer patients and an undisclosed number of employees.
Two recently patched vulnerabilities in PaperCut NG and MF print management software are being actively exploited in data theft campaigns. The zero-days were patched last week after initial exploitation was discovered.
Inexpensive GPS jamming devices are proliferating globally, disrupting navigation systems across civilian infrastructure. The low cost and easy availability of these tools are creating widespread interference zones.