Public GitHub repository tied to CISA contractor exposed internal credentials and AWS GovCloud access

Tuesday, May 19, 2026Technology & SocietyWell-covered3 frames

A public GitHub repository named "Private-CISA" exposed sensitive material tied to the Cybersecurity and Infrastructure Security Agency.
Multiple reports say the repository was maintained by, or linked to, a contractor working for CISA, identified in several reports as Nightwing.
The exposed material included plaintext passwords, tokens, keys, and credentials for internal CISA systems and AWS GovCloud accounts.
Researchers said the repository also contained internal technical and operational files, including documentation or logs related to software builds, deployment workflows, and infrastructure.
GitGuardian researcher Guillaume Valadon is widely cited as having discovered or flagged the repository in May 2026 after public-code monitoring detected it.
Several reports say the repository had been publicly accessible since November 2025, meaning the exposure lasted for about six months before it was taken down.
The repository was later taken offline or locked down, and CISA said it had no indication that sensitive data was compromised and that it was adding safeguards.
The incident has prompted broader scrutiny because it may have exposed access to government cloud and internal agency systems, and some reporting says it has already drawn congressional attention while key questions about misuse remain unresolved.

How left and right are reading this

Both agree: A months-long public exposure of plaintext credentials and internal operational files tied to government cloud and agency systems reflects a serious breakdown in handling sensitive access, with unresolved questions about misuse despite the repository being taken offline and safeguards added.
They split on: Less a disagreement than a question of emphasis: the risks of relying on contractor-managed systems for core public cybersecurity functions versus the need for stricter stewardship and oversight when sensitive government access is involved.

A public GitHub repository named "Private-CISA" exposed sensitive material tied to the Cybersecurity and Infrastructure Security Agency.
Multiple reports say the repository was maintained by, or linked to, a contractor working for CISA, identified in several reports as Nightwing.
The exposed material included plaintext passwords, tokens, keys, and credentials for internal CISA systems and AWS GovCloud accounts.
Researchers said the repository also contained internal technical and operational files, including documentation or logs related to software builds, deployment workflows, and infrastructure.
GitGuardian researcher Guillaume Valadon is widely cited as having discovered or flagged the repository in May 2026 after public-code monitoring detected it.
Several reports say the repository had been publicly accessible since November 2025, meaning the exposure lasted for about six months before it was taken down.
The repository was later taken offline or locked down, and CISA said it had no indication that sensitive data was compromised and that it was adding safeguards.
The incident has prompted broader scrutiny because it may have exposed access to government cloud and internal agency systems, and some reporting says it has already drawn congressional attention while key questions about misuse remain unresolved.