GitHub gets autoscanned by thousands of malicious actors for keys and credentials on every commit, including the comments lol.
The fact that CISA themselves never saw an automated breach attempt only minutes after pushing to github is the more interesting story here.
Either the contractor is so incompetent that they didn’t have any logging set up and the breach went completely unnoticed for 6 months.
Or this really is some fat honeypot that they won’t admit is a honeypot because they’ve been using it to watch or bait APTs.
Currently, there is no indication that any sensitive data was compromised as a result of this incident
This is literally impossible unless it really was a honeypot. You can demo this yourself in real time. Make a throwaway cloud account on your favorite provider, commit the cloud auth token into a repo, and you will see an automated bot login within minutes.
Commiting any secrets to a public repo should just be considered auto compromised because of how potent it is.
That stuff ususlly gets exposed via poor CI/CD permissions where credentials are required, but straight up file commit is like publicly announcing exactly where you left your house keys lol.
Straight up file committing is like making a copy of your house keys for anyone who can see you at that moment and all moments thereafter lol
Imagine fucking up so bad security researchers think it must be an obvious honey pot until they see what the credentials give access to
Is this the same cybersecurity agency that fired all its professionals to replace them with sycophants?
I’m surprised whatever software the keys were for didn’t detect this and deactivate the keys. Discord did this automatically when I pushed a file to github that had a bot login token in it. Apparently Discord constantly scans github for such things, or maybe github does and sends Discord a msg, I dunno. But it was amazingly fast, like within 2 minutes.
that feature was probably deactivated, just like the feature on github which prevents uploading of SSH keys that had been explicitly disabled
No, I just checked - it’s part of github’s “Secret Scanning”, which checks pushes for secret values and notifies partner services (like Discord) to deactivate them.
…but remember, everything needs to be written in memory safe languages to stop security breaches.
“I might get mugged in a dark alley, so why should I bother locking my door at home?”
Security breeches stop your phone falling out while riding a horse.
Six months of exposure.
There is zero chance that the CISA systems have not been comprehensively breeched by every foreign adversary.
Good thing Trump cut 1/4 of their workforce last year. It’s really paying dividends for Putin.
that chain saw is not at the correct height
It’s only…what, about half a metre too high ?
It doesn’t seem to have kickback brake, so it kinda is. It just should be running on full speed and hit something on the tip.
Bye Elon!
All going to plan, comrade
Breached? But we left the keys in the ignition and the door was wide open. We could have, you know, tried.
reminds me of when i lived in nashville and there had to be news bulletins reminding people to not leave firearms in their cars, as they were getting stolen.
we could not have done shit.
jesus christ
This regime has caused so much damage to our national security, much of which we won’t discover for years or decades. The Russians and Chinese (and literally anyone else) are probably fully infiltrated into our entire system in every aspect. SO fucking incompetent and corrupt.
We’re also creating generations of new enemies and potential “terrorists”.
And Democrats will inevitably be blamed when they attack us in the future.
I think we’re headed towards a Troubles type scenario. Like a decade or more of stochastic terrorism, some organized groups, lots of violent suppression by the government, and further corporate capture of the state. I guess that’s just the fascist end goal.
We’re barely even trying with the massive cuts to cyber security. It’s almost the exact playbook you would use if leadership were actively hostile.
Trump and co are actively hostile to the US government though. There have been entire books written about how compromised he is. He’s the perfect insider threat example: in debt to foreign powers, selfish and looking to make personal money, lies about his dealings, easily temptable with honeypot women (and Epstein girls, fucking sick), no allegiance or any form of duty to country or anything bigger than himself because he’s a massive nihilist narcissist.
Really really scary times for anyone in America.
Don’t worry, soon the folks in charge will come to the inevitable conclusion that the government systems are all compromised, so clearly the only solution is to privatise them and have thevNSA run by Palantir.
you joke… but that’s literally the plan. Thiel, Musk, Andreeson, Horowitz, and the rest of the Yarvinites are trying to consume as much of the government and state power as possible.
See, that’s the thing. I always grew up with the phrase “Don’t blame on malice what can be explained by incompetence”.
But at a certain point, IS it incompetence anymore??? At this point it’s starting to feel very very deliberate.
In this case it is both malice and incompetence acting together to create the worst possible outcomes.
Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.
But wait
Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.
“Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature,” Valadon wrote in an email. “I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career. It is obviously an individual’s mistake, but I believe that it might reveal internal practices.”
One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers.
This is shameful incompetence. Just head-rolling abysmal incompetence. These are the people they hired, for all you 1337 hax0rz currently looking.
As a dev who’s been unemployed for 18 months your last sentence was pretty much my first thought when reading the article.
Sorry, I hear ya. You are so not the only one either. Hang in there. Hey - this place may have some open positions soon?
Outside of the sheer incompetence of this administration, is there ANY chance this was done intentionally as a honeypot or something along those lines?
The fact that the commits were explicit along with bypassing all the checks could read as someone trying to see who knocks on the door.
I don’t see it. Like the guy in the article said, it starts out looking like a joke . . . Buuuut it ain’t.
ELIT please.
Explain like im Trump in case you didn’t get the T bit. Sorry.
Our best and finest left the safe combo next to the safe and then left for 6 months.
Best and finest indeed. Thanks for the dumbing down for me.
Woke computer nerds fucked us
Edit: just to reassure the more anxious amongst us, I mean ‘woke’ in the maga sense of anything-i-don’t-like-is-woke. Not actually woke.
Actually woke computer nerds observe proper security protocols ffs.
Unfortunately you can’t ironically pretend to be a dumb asshole on the internet because you become indistinguishable from the actual dumb assholes
Why are people acting surprised? This is exactly what DOGE intended to do.
This is like being surprised someone died in a fatal car accident after their wheel came off on the highway because they handed a wheel and lug nuts to a 10 year old and said “put this on”
Defund DHS.
Wow. Wowowowowowowowow. Wow.
This is the only logical reaction, honestly 🤣
It was super easy! Barely an inconvenience!
Fast. Cheap. Good.
At best, pick 2.
This applies to code and coders as well, despite management’s inability to comprehend reality.
vibe code go brrrrrrr
EDIT: wow it’s far worse, it was a single contractor that decided that his convenience was above any and all security recommendations ever written. Pure. Genius!
Contractor, eh?
How much do you wanna bet he has close personal ties to the trump family and zero cybersecurity experience?
Leaving passwords in plaintext has zero to do with “vibe coding”
It definitely can if an LLM did it.
yeah, and this is why I edited my original post after reading the article.
Only the best people
Here’s a link to the Krebs on Security article that Gizmodo used as a source: https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
Its dumb shit like this that reassures me that AI will definitely take over cyber security jobs and make shit even LESS secure than everything already is.
the few who will stay sharp will have endless job security
