The federal agency tasked with defending America from cyber threats has been caught leaving its own digital secrets exposed online in what one cybersecurity expert called “the worst leak that I’ve witnessed in my career.”

According to a bombshell report from Krebs on Security, the U.S. Cybersecurity and Infrastructure Security Agency, better known as CISA, accidentally left passwords, access keys, and authentication tokens sitting publicly on GitHub for an unknown period of time. Some of the credentials were reportedly stored in plain text inside a .CSV file, creating a stunning security failure at the heart of the federal government’s cyber defense apparatus.

And the name of the repository only made the situation more alarming.

It was reportedly called “Private-CISA.”

Passwords and Government Cloud Credentials Left Exposed

The exposed files allegedly included administrative credentials connected to Amazon AWS GovCloud servers, systems designed specifically for sensitive government operations.

One file, titled “importantAWStokens,” reportedly contained credentials tied to three AWS GovCloud servers. Another file, named “AWS-Workspace-Firefox-Passwords.csv,” allegedly exposed usernames and passwords for dozens of internal CISA systems.

According to Krebs, the systems included one identified as “LZ-DSO,” believed to stand for “Landing Zone DevSecOps,” the agency’s secure code development environment.

The implications immediately triggered concern across the cybersecurity community.

“I’m no expert on federal Cybersecurity, but this from Krebs sounds like stuff we as citizens don’t want our government leaking,” the article noted before detailing the exposed systems.

CISA Says There’s No Evidence of Compromise

CISA acknowledged the incident in a statement provided to Krebs on Security, insisting there is currently no evidence that the exposed data was exploited.

“Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”

The repository was reportedly created in November of last year, suggesting the vulnerability may have existed for roughly six months. However, the exact timeline remains unclear because it depends on when the sensitive information was uploaded.

The issue was reportedly fixed over the weekend.

Cybersecurity Expert Calls It “The Worst Leak” of His Career

The alarming discovery was reportedly made by Guillaume Valadon of GitGuardian, a cybersecurity company that scans GitHub repositories for exposed secrets and credentials.

Valadon, whose work revolves around identifying dangerous leaks exactly like this one, did not mince words about the severity of what he found.

He told Krebs it was “the worst leak that I’ve witnessed in my career.”

That assessment is likely to intensify scrutiny on CISA at a moment when the agency is already facing mounting political and operational turmoil.

Trump-Era Agency Faces New Embarrassment Amid Internal Chaos

CISA was established in 2018 during President Donald Trump’s first administration as part of an effort to strengthen the nation’s defenses against cyberattacks, foreign hackers, and digital threats.

At the signing ceremony, Trump described the growing cyber threat landscape in dramatic terms.

“The cyber battlespace evolves — and it is evolving, and unfortunately, faster than a lot of people want to talk about. But battlespace it is. So as the cyber battlespace evolves, this new agency will ensure that we confront the full range of threats from nation-states, cyber criminals, and other malicious actors, of which there are many.”

Years later, the agency now finds itself at the center of a deeply embarrassing cybersecurity controversy.

Following the 2020 election and the events surrounding January 6, 2021, Trump clashed with CISA leadership over statements related to election integrity and ultimately fired the director he had appointed. Since returning to office, Trump’s relationship with the agency has remained turbulent.

Neither acting director appointed during his current term has reportedly been confirmed by the Senate, and the administration has recently pushed to significantly reduce CISA’s funding.

Now, this latest incident threatens to further damage confidence in the agency responsible for protecting critical U.S. infrastructure from cyber threats.

Contractor Activity Raises More Questions

According to one interpretation of the Krebs report, the exposed repository may have been tied to an employee working for government contractor Nightwing.

The report suggests the employee may have been using GitHub as a method to transfer work materials between devices, effectively moving files from a work machine to a personal device in a highly insecure manner.

The possibility that sensitive government credentials may have been handled this casually is already raising serious questions about internal safeguards, contractor oversight, and operational discipline inside one of America’s most important cybersecurity agencies.

For an organization tasked with preventing catastrophic digital breaches, critics say the incident represents exactly the kind of mistake it warns others against every day.