America's top cyber-defense agency left a GitHub repo open with passwords, keys, tokens – and incredibly obvious filenames

The US Cybersecurity and Infrastructure Security Agency (CISA) left open a GitHub repository named “Private-CISA” containing plain-text passwords, private keys, tokens, and secrets – with obvious file names like “external-secret-repo-creds.yaml” and “AWS-Workspace-Firefox-Passwords.csv” – for six months. GitGuardian researcher …

[RockBurner]

Yahoo?

People still have yahoo emails?

<desperately trying to remember if I had one....>

[DJV]

Re: People still have yahoo emails?

Yeah, unfortunately, they do - one's a website client of mine and I've warned him several times about their skanky service and the need to whitelist accounts of people he knows - many of my emails to him either disappear or end up in his spam folder. But, despite my warnings, does he ever do anything about it? Of course not.

[Anonymous Coward]

Re: People still have yahoo emails?

Your software permits delivery to @yahoo.com email addresses? Ours blocks it by default.

[Homo.Sapien.Floridanus]

Re: Yahoo?

Yeah, ahem… thanks for finding and broadcasting our honeypot.

CISA

[Anonymous Coward]

Re: Yahoo?

Man the nostalgia in that question.

Everyone with an email address back in the day probably had a Yahoo email address at some point if they're over a certain age. They were pretty much the only free mail provider with a decent webmail UI for quite a while. That changed with hotmail.com though.

It's insane how much grip Yahoo had that they then fumbled.

[steviebuk]

Re: Yahoo?

Yep. And, I can't remember what movie it was, was a comedy, while on a golf course, time travel related, someone said something along the lines of "Remember the name Yahoo and reserve it". Ignoring the fact if the name was reserved, they'd have probably gone with something else.

[Uncle Slacky]

Re: Yahoo?

Sounds like "Hot Tub Time Machine" but it was Google, not Yahoo.

[Will Godfrey]

Re: Yahoo?

Nope. Never had Yahoo. First personal one was with demon.. Interestingly I can't remember it, and can't find it anywhere in ancient history files.

[IGotOut]

Re: Yahoo?

I've still got one. Pretty sure everything in there is for spammy accounts or for companies I know 100% are going to flog the info.

[TooOldForThisSh*t]

Re: Yahoo?

Not Yahoo, but until quite recently my best friend had (and used) an AOL email address. Within the past month I discovered his emails are now GMAIL. Now I have one less thing to razz him about :)

[Anonymous Coward]

Re: Yahoo?

Yes, but GMail is just shit with your email in a different way…

[Elongated Muskrat]

Re: Yahoo?

To be fair, I still have a yahoo email address, and it works just fine; it's probably one of the few free email providers of the time that is still going.

Given that they have stood the test of time, are you suggesting I switch to another provider? Yes I have a Google email address, but the interface to Google mail is god-awful, and they rate-limit POP3 and IMAP access.

As with all things, you get what you pay for, and for zero pounds and zero pence, their offering is both long-lived and pretty reliable. I think maybe snootiness is playing a part here, I wonder how many email providers of today will still be about in 20 years' time?

[Anonymous Coward]

Bigly huge

All in the title.

[Anonymous Coward]

Re: Bigly huge

Perhaps GitHub just needs shut down …. For the good of all mankind.

Trump can send his ICE Goons in - Smash, Smash, Smash.

[Anonymous Coward]

It's gotta be a honeypot; NOBODY could be that stupid!

[Paul Crawford]

NOBODY could be that stupid!

Have you seen the current administration?

[Blazde]

Obviously a training exercise, like when they set that tall thin concrete shell building on fire at the fire station.

Hey... is the fire truck supposed to be burning like that? Is that part of the exercise? It looks pretty bad. Do you need any help with that?

[Anonymous Coward]

Are you new to this planet?

No matter how stupid someone could be they will beat your expectation of how not stupid they will be.

It's the stupid paradox and I can confirm this as I am stupid.

[Anonymous Coward]

Me and a colleague actually defined professional stupidity mathematically a couple of decades ago for the laughs...it was an equation that worked quite well when determining if a person we hadn't worked with before was technically incompetent. I wish I still had it...alas it became lost to time.

We tested it across all known members of staff at the company we worked at and graphed it...it was pretty bang on.

We were given a written warning for it because "calculating someones level of competence could be deemed to be offensive"...by that, what my line manager meant was that he was offended that he came out as below average competence for the company...actually the lowest by quite a margin.

The variables we took into account were length of service in their current role, total time spent at the company, average number of cock ups per month, number of times they had been promoted, total time logged in the timesheets and a few others.

Time served at a given company and the number of hours officially logged in the timesheets were the biggest determining factor a lot of the time...and you could actually graph timesheet hours per month against a time series and map the competence decline...also the longer you've served at a given company, the nearer to 0 you trend on the competence scale...we forecasted that it would only have taken an additional 4 years at the company for our line manager to become thick as mince and functionally useless.

Us: Guys, we've made a formula to work out how useless or competent someone is.

Office: lol

Manager: Hah, alright then, lets see the results...who is the dumbest person here based on your maths?

Us: Haha ok then, it was you by about 32%...see look at these charts.

Office: ROFL! *literal tears of laughter all around*

Manager: *shock* You two, my office, now!

Man, he got shit for a long time after that.

Manager: I reckon we should approach this like XYZ.

Engineer: Sounds good, but mathematically speaking...

[Enric Martinez]

OR... pissed off CISA employees or ex-employees shortly before being fired.

[Anonymous Coward]

seemed too good to be true

Too bad to be true?

[ComputerSays_noAbsolutelyNo]

Re: seemed too good to be true

Too bad that it is true

[Enric Martinez]

Re: seemed too good to be true

Had it been a honeypot, the researcher who found it would have been made aware the first time he contacted the CISA people, and nobody besides the CISA and researcher would have been the wiser.

OR, it actually was a honeypot operated by a team that was fired.

If this was the case, it's still awful PR for CISA and an eventual signal to hackers that the current team is dysfunctional and an open invitation to hackers.

[GoneFission]

The most confusing part of this administration is the inability to tell whether something was done due to active, intentional malice or sheer incompetence. Not that one is any better than the other, but you'd at least hope a hostile actor got paid to do this.

[ComputerSays_noAbsolutelyNo]

Sort of Schrödinger's Hanlon's razor

[Gerhard den Hollander]

The email account was called [e-mail] ?

Although I think most of the doge geniuses were too young to be allowed a yahoo! Email! Account!

But maybe Elmo held their hands ( or other body part ) while they signed up ?

[Tron]

disabling GitHub's secret scanning.

Not quite so secret.

The whole thing yells honeypot.

[earplugs]

Wonder if "CISA Secrets.csv" is related to CISA or secrets?

[goblinski]

The primary cuts, structural changes, and key leadership shifts impacting CISA include:

1. Mass Personnel & Contract Cuts:

- Red Team Terminations:

DOGE eliminated CISA’s entire core "red team" (the specialized ethical hackers who simulate cyberattacks to find network vulnerabilities) along with their support roles.

A follow-up cut eliminated a second red team doing critical work.

In total, over 100 highly skilled penetration testers and operators had their contracts abruptly ended.

- Probationary Employee Layoffs: In mid-February 2025 (during an event federal workers dubbed the "Saint Valentine's Day Massacre"), DOGE directed the Office of Personnel Management (OPM) to slash probationary staff. This resulted in the firing of roughly 130 probationary CISA workers.

-Election Security & Disinformation Experts: The cuts heavily targeted CISA's election security advisers (the non-partisan liaison experts coordinating security with state and local governments). Concurrently, many staff members assigned to CISA’s foreign influence and disinformation teams were placed on administrative leave.

2. Major Defunding & Partner Dissolutions:

- Termination of the $10M CIS Partnership: CISA cancelled its multi-million dollar cooperative agreement with the Center for Internet Security (CIS). This effectively shut down federal funding for two major cyber-threat info-sharing hubs: the Multi-State Information Sharing & Analysis Center (MS-ISAC) and the Election Infrastructure Information Sharing & Analysis Center (EI-ISAC).

- Disbanding of the Cyber Safety Review Board: The administration disbanded the Cyber Safety Review Board, pausing deep-dive federal post-mortem investigations into major corporate and governmental hacks.

3. Leadership Shakes-up:

The Exit of Jen Easterly: Longtime CISA Director Jen Easterly officially stepped down on January 20, 2025.

Nomination of Sean Plankey: To fill the vacancy, President Trump nominated Sean Plankey to become the new Director of CISA. Plankey is a Coast Guard veteran who previously served as the Navy's Deputy Chief Information Officer (CIO) for Naval Intelligence and worked on cyber policy during the first Trump administration

[Anonymous Coward]

AI slop? Looks good…looks like slop.

[pip25]

"Managing to take the repository offline in a day is impressive work."

Is it? For a leak this bad?

[ChoHag]

Re: "Managing to take the repository offline in a day is impressive work."

If you're so bad that you have this leak in the first place ... yes?

[Enric Martinez]

Re: "Managing to take the repository offline in a day is impressive work."

Open repo > Settings > scroll down :

a) Change Visibility > Private

OR

b) Delete this Repository > I want to delete this repository

Took me 1 minute to figure out without asking a chatbot or googling.

NOTE: I use Gitlab, my Github repo is only for my Kitty config files.

[An_Old_Dog]

Survey Says ...

A CISA spokesperson told The Register that it was aware of the report and is investigating. "Currently, there is no indication that any sensitive data was compromised as a result of this incident.”

In other words: "I surveyed my cat, Mittens, who did not affirm she misused any of the leaked credentials. So, currently, there is no indication that any sensitive data was compromised as a result of this incident.”

[AVR]

Re: Survey Says ...

The person who alerted them confirmed that the files were real; that's a compromise of sensitive data by definition (if perhaps not a serious breach), even before you find out whether any other contractors, outside hackers or what have you have accessed them.

[TonyHoyle]

So for 6 months their admin passwords were online but 'there is no indication that any sensitive data was compromised'

a) Your admin passwords are sensitive data.. If you don't believe this you have no business running an IT system.

b) The bad guys have wiped the logs, you buffoons. Your *entire system* should be considered compromised at this point. God knows how you roll back 6 months, assuming the backups aren't compromised too..

and c) You're a fucking cyber security agency. If *you* can't get this right then we're fucked.

Unless it is indeed just a honeypot, but really I don't get those vibes from that response.

[steviebuk]

And this admin is so fucked, wouldn't surprise me if it was just incompetence and they are all mates of mates of mates of orange man. The whole admin is one big grift.

[Always Right Mostly]

Our company has to deal with CISA. This confirms what I have always thought ot them - fuckig morons, security theater that explodes developmet costs.

[blu3b3rry]

I'm sure Markwayne Mullin is on the case.

[BartyFartsLast]

Quis custodiet ipsos custodes?

"It will never happen to us"

The swansong of many

[Locomotion69]

Why on Earth is an organisation like this one using a public cloud service for information like this ?

How hard is it to set up an internal Git repository for this purpose ??? (Hint: not difficult at all). Information like this should never be kept outside the organisation boundaries.

[T. F. M. Reader]

Were there any Polymarket bets...

.. on whether this was a honeypot (or a humongous and elaborate collection of baits pointing to honeypots) and/or how quickly it would be outed?

[sabroni]

"Managing to take the repository offline in a day is impressive work"

No, it really fucking isn't.

This is a complete shit show and the fact they took action after the press got notified does not make this "impressive work", it makes it a desperate attempt to shut the stable door months too late.

[MattieD]

The last job

Sounds a lot like someone was told to make all this information available to either the DOGE kids or their 'replacement' when they were getting 'rightsized' out of the organisation.

A nice bit of malicious compliance. Technically, the information is available to their replacement. It's just also available to the rest of the world. Unless they were told to make it secure, then it's very much Someone Else's Problem.

[doublelayer]

Re: The last job

Another possibility is that someone was asked for the credentials, provided them somehow, and the recipient is the one who posted them to a repo to store them. Even that wouldn't be the most relieving because anyone with too many credentials to store should have a more organized method for doing so securely. Unfortunately, credential management is a thing where many organizations don't have great answers and looking at what they do just shows you a horror which will be very painful to clean up.

[MattieD]

Re: The last job

credential management is a thing where many organizations don't have great answers

The answer is usually an Excel spreadsheet saved to SharePoint... Occasionally it might even be password protected. With the password in a Word document in the same folder called password.docx.

[Anonymous Coward]

Looking at the bright side

At least someone takes transparency seriously in us.gov

[Richard Boyce]

An unauthorised copy?

Could this be more than just incompetence, and the work of a rogue individual? Someone on the inside deciding to use this means of storing and sharing his personal cache of sensitive info?

[kahara]

No forking needed

Am I not understanding something essential because taking fork count as any kind of indication about anything seems wrong. Unless someone specifically wanted to signal back to the owner that "I have your files".

Also, even though this is a major bureaucratic entity, a day's response time can't possibly be considered "impressive"? In this line of work, at least.

[WSWS]

Gee, I wonder why anyone might want to cut funding for an organisation unfit for purpose and so obviously filled with incompetence?

[Anonymous Coward]

Ho Hum !!!

The 'Honeypot' spin appears to be more likely a desparate attempt to make it look 'less' of a screw-up !!!

Can anyone confirm the 'Honeypot' idea as being true ???

:)

[Filippo]

Re: Ho Hum !!!

Well, the thing is, if you run a honeypot, you don't want the bad guys to figure out that you're running a honeypot, or even that you were running a honeypot until yesterday (otherwise, they'll be more suspicious of future honeypots).

So, in this case, an amazingly competent CISA would look exactly the same as an amazingly incompetent CISA. Each of us can pick their favorite version, happily call the other camp idiots, based on the same amount of evidence.

[Henry Wertz 1]

CISA gutted

CISA was one of the many US agencies where they had like half their staff laid off, and 'internal reorganization'. So, I imagine the guys and gals that would have known not to do that aren't there any more.

[TimMaher]

Brian Krebs

Telling him is what may have put the shits up CISA.

[𝚘𝚖𝚘𝚗𝚍𝚒]

The most confusing part of this administration is the inability to tell whether something was done due to active, intentional malice or sheer incompetence. Not that one is any better than the other, but you'd at least hope a hostile actor got paid to do this