Technology

GitHub gets autoscanned by thousands of malicious actors for keys and credentials on every commit, including the comments lol.

The fact that CISA themselves never saw an automated breach attempt only minutes after pushing to github is the more interesting story here.

Either the contractor is so incompetent that they didn't have any logging set up and the breach went completely unnoticed for 6 months.

Or this really is some fat honeypot that they won't admit is a honeypot because they've been using it to watch or bait APTs.

Currently, there is no indication that any sensitive data was compromised as a result of this incident

This is literally impossible unless it really was a honeypot. You can demo this yourself in real time. Make a throwaway cloud account on your favorite provider, commit the cloud auth token into a repo, and you will see an automated bot login within minutes.

Commiting any secrets to a public repo should just be considered auto compromised because of how potent it is.

That stuff ususlly gets exposed via poor CI/CD permissions where credentials are required, but straight up file commit is like publicly announcing exactly where you left your house keys lol.

Imagine fucking up so bad security researchers think it must be an obvious honey pot until they see what the credentials give access to

Is this the same cybersecurity agency that fired all its professionals to replace them with sycophants?

I'm surprised whatever software the keys were for didn't detect this and deactivate the keys. Discord did this automatically when I pushed a file to github that had a bot login token in it. Apparently Discord constantly scans github for such things, or maybe github does and sends Discord a msg, I dunno. But it was amazingly fast, like within 2 minutes.

huh, so they've never used npm?

Six months of exposure.

There is zero chance that the CISA systems have not been comprehensively breeched by every foreign adversary.

Good thing Trump cut 1/4 of their workforce last year. It's really paying dividends for Putin.

Honeypot?

jesus christ

This regime has caused so much damage to our national security, much of which we won't discover for years or decades. The Russians and Chinese (and literally anyone else) are probably fully infiltrated into our entire system in every aspect. SO fucking incompetent and corrupt.

Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.

But wait

Valadon said the exposed CISA credentials represent a textbook example of poor security hygiene, noting that the commit logs in the offending GitHub account show that the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.

“Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature,” Valadon wrote in an email. “I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career. It is obviously an individual’s mistake, but I believe that it might reveal internal practices.”

One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers.

This is shameful incompetence. Just head-rolling abysmal incompetence. These are the people they hired, for all you 1337 hax0rz currently looking.

Fast. Cheap. Good.

At best, pick 2.

This applies to code and coders as well, despite management's inability to comprehend reality.

Why are people acting surprised? This is exactly what DOGE intended to do.

vibe code go brrrrrrr

EDIT: wow it's far worse, it was a single contractor that decided that his convenience was above any and all security recommendations ever written. Pure. Genius!

Here's a link to the Krebs on Security article that Gizmodo used as a source: https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

Wow. Wowowowowowowowow. Wow.

...but remember, everything needs to be written in memory safe languages to stop security breaches.

Defund DHS.