CISA Contractor GitHub Credential Leak

Technical Analysis

The root cause was long-lived plaintext cloud credentials (AWS GovCloud access keys) and other secrets committed to a public GitHub repository by a third-party contractor, with no automated secret-scanning or DLP control catching the exposure internally. The leak persisted for approximately six months, indicating absence of credential rotation policies, repository monitoring, and GitHub secret-scanning alerts/push protection, and was only remediated after external disclosure via a security researcher/journalist. This reflects a common supply-chain and third-party risk pattern where contractor-managed code repositories bypass an organization's internal security tooling and governance. Organizations running AI agents or LLM-based tools that rely on cloud API keys, GitHub-hosted repos, or contractor-developed integrations face similar exposure risk: leaked cloud credentials of this type can be leveraged to access training data, model endpoints, vector stores, or orchestration infrastructure if agent pipelines share credential stores or CI/CD paths with exposed repositories.

Affected Systems

Public GitHub repositories used by government contractors; AWS GovCloud accounts and associated IAM access keys; contractor CI/CD and code-hosting environments lacking secret-scanning enforcement

Indicators of Compromise

• N/A - no technical indicators (hashes/IPs/domains) reported; incident centers on exposed AWS GovCloud API keys and credentials in a public GitHub repository

Remediation Steps

1. 1

   Immediate credential rotation

   Revoke and rotate all exposed AWS GovCloud keys and any other credentials found in the repository; audit for downstream use of the compromised keys.

2. 2

   Enable automated secret scanning

   Deploy GitHub secret scanning, push protection, and third-party DLP tools across all contractor and internal repositories, public and private.

3. 3

   Enforce contractor security requirements

   Mandate that contractors follow the organization's secrets-management policies, including pre-commit hooks and repository access reviews, as a contractual requirement.

4. 4

   Implement continuous repository monitoring

   Use automated tools to continuously scan public code hosting platforms for organizational credentials and sensitive data leakage.

5. 5

   Establish incident response SLAs

   Create clear internal procedures and timelines for responding to externally reported credential leaks to avoid multi-month exposure windows.

6. 6

   Least-privilege IAM policies

   Apply least-privilege scoping and short-lived credentials (e.g., STS tokens) for cloud access instead of long-lived static keys.