CISA has released a set of lessons learned from a cyber incident first reported by KrebsOnSecurity on May 18 wherein dozens of CISA internal passwords and govcloud credentials were exposed in a public GitHub repository marked "Private CISA" for several months. The CISA report says they immediately took steps to stop the bleeding, including: -The reported public repository was taken offline and a copy was saved for later analysis. This repository was not part of CISA’s official GitHub but rather was a personal repository owned by a contractor. -CISA’s development environment was taken offline and associated credentials were reset. -The individual who exposed the keys had their system access revoked. As for what could be strengthened, the agency said CISA users had the ability to upload to public repositories. "Following review of our Zero Trust tooling, CISA determined the best way to monitor and manage uploads was to leverage our endpoint detection and response (EDR) solution. This approach enables CISA developers to pull code from public repositories while reducing the risk of uploading intellectual property or sensitive content to public repositories." https://www.cisa.gov/news-events/news/lessons-cisas-cyber-incident Our reporting on this: https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/ https://krebsonsecurity.com/2026/05/lawmakers-demand-answers-as-cisa-tries-to-contain-data-leak/