The U.S. cybersecurity agency, CISA, has suffered a major embarrassment after a contractor’s employee exposed reams of sensitive credentials in a GitHub repository. The breach includes access tokens and cloud keys, raising questions about the robustness of CISA's own security standards.

Guillaume Valadon, a security researcher from GitGuardian, flagged the issue to independent security reporter Brian Krebs after testing some of the exposed keys and finding them valid. The credentials were reportedly used for accessing systems belonging to both CISA and its parent agency, the Department of Homeland Security.

CISA’s responsibility to advise on best cybersecurity practices, including storing passwords in secured password managers, has come into question following this incident. The U.S. government agency is currently without a permanent director since January 2025, and has lost about a third of its workforce due to cuts, furloughs, and layoffs.

While it’s unclear if anyone else found or used the exposed credentials, CISA has not yet confirmed any evidence of a breach. The agency is responsible for cybersecurity across the civilian federal network and advising on best practices, making this incident particularly poignant. TechCrunch asked if CISA had revoked and replaced the affected credentials, but received no immediate response.