CISA Public GitHub Repo Leak Exposes 844 MB of Credentials, Tokens, and Docs
What Happened — On 13 Nov 2025 a public GitHub repository titled “Private‑CISA” unintentionally published 844 MB of data, including plaintext passwords, AWS tokens, and Entra ID SAML certificates. The exposure was discovered by GitGuardian on 14 May 2025 and fully mitigated 26 hours later after CISA removed the repo and reset all compromised credentials.
Why It Matters for Compliance & Audit Readiness
- The incident is a textbook example of a credential‑compromise scenario that SOC 2 § CC6.1 (Logical Access Controls) is designed to prevent and evidence.
- Continuous monitoring of code repositories and a tested incident‑response playbook provide the audit‑ready evidence required for the SOC 2 “Security” principle.
- Demonstrating rapid detection, containment, and transparent reporting satisfies the “Monitoring” and “Risk Management” criteria of SOC 2 and helps maintain trust with stakeholders.
Who Is Affected – Federal government agencies, contractors handling public‑sector code, and any organization that stores secrets in version‑control systems.
Recommended Actions
- Implement automated secret‑scanning tools (e.g., GitGuardian) on all public and private repositories.
- Enforce least‑privilege IAM policies and rotate credentials immediately after any exposure.
- Formalize a secret‑leak response playbook and conduct regular tabletop exercises.
- Ensure comprehensive logging and alerting for credential use to support SOC 2 audit evidence.
Source: DataBreachToday
Technical Notes – The leak stemmed from a contractor uploading internal IaC and build repositories to a personal GitHub account, exposing admin and build credentials. No evidence of credential misuse outside CISA environments was found. Source: [DataBreachToday]