TLDR Tech / InfoSec
Lessons Learned from CISA's Recent GitHub Leak
A contractor left a “Private CISA” GitHub repo public for six months, exposing AWS GovCloud admin keys and plaintext passwords for internal CISA systems. GitGuardian's automated alerts went unanswered, and key rotation took more than 48 hours after external notification. CISA is tightening incident-reporting channels and expanding continuous scanning of public and internal code for secrets to catch similar leaks faster.
Read the full story