CISA Admin Leaked AWS GovCloud Keys on GitHub
182 points
8 hours ago
| 9 comments
| krebsonsecurity.com
| HN
john_strinlai
1 hour ago
[-]
>Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.

obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy.

but wait! it gets worse somehow

"“AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems"

while i understand and sympathize with the fact that CISA is kind of being gutted, a passwords.csv with weak passwords is inexcusable incompetence. not much budget is required for a password manager.

embarrassing all around.

reply
tantalor
1 hour ago
[-]
The word you're looking for is "gross negligence"
reply
gleenn
30 seconds ago
[-]
Sometimes I feel like it's a cover for some other org actually just wanting to steal the data and this being the excuse.
reply
john_strinlai
1 hour ago
[-]
"crazy crazy" gets the same point across
reply
binkHN
37 minutes ago
[-]
Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.
reply
sandeepkd
18 minutes ago
[-]
While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security.

The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than something thats shared across the company/group

reply
totetsu
1 hour ago
[-]
One the one hand the CISA is being gutted, and on the other hand there is an ever increase of rhetoric about cybersecurity, national interests, critical infrastructure..
reply
mystraline
1 hour ago
[-]
Most of the folks I know who were with CISA were purged with the January-March 2025 Doge campaign. 0 notice "we 20 year olds dont understand what you do so fired".

A group was working on Diebold voting insecurity, and foreign implant hacking. Gone.

reply
throwaway5752
53 minutes ago
[-]
DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them.

It is a bad plan that has and will continue to harm people, but it is intentional.

reply
parineum
2 minutes ago
[-]
Which DOGE employee put this file on GitHub?
reply
jimt1234
41 minutes ago
[-]
The first "hack" I ever reported was when I found a plaintext passwords file on my high school computer network...in 1987. The more things change, the more they stay the same.
reply
delfinom
23 minutes ago
[-]
Dealing with IT departments run wild with cyber security monkeys that can only follow checklists with no independent thought.

The spreadsheet of passwords is a tad more common than it should be because the password managers don't meet whatever arbitrary checklist of invented cyber security requirements they blindly follow. But Excel does.

Lol

reply
modriano
1 hour ago
[-]
Sure, it could be incompetence. It could also be an intentional strategy to tie up CISA/DHS resources, poison or obstruct CISA/DHS investigations/operations, open up systems to sunlight and journalism, or cause general chaos.

The not-responding-when-notified part makes me think it's not just incompetence.

reply
stackskipton
1 hour ago
[-]
>The not-responding-when-notified part makes me think it's not just incompetence.

Strong disagree. The person in question probably thought it was a private repo on Github and had a massive deer in headlights reaction when they got contacted. Whoever this is, lost their job, possibly security clearance and more. This was 100% life altering "mistake"/gross incompetence decision they made.

reply
SoftTalker
11 minutes ago
[-]
the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories.

That doesn't support the theory that it was a mistake. That was intentional action. Maybe he was being blackmailed, and was coerced to do it. Or maybe he was a foreign agent or sympathizer who had infiltrated the organization.

reply
modriano
49 minutes ago
[-]
Maybe. I didn't see enough in the article about the repo owner/committer to make any inference about their intentions and wouldn't jump to conclude it was incompetence or malice or crafty leaking. The only real signal I saw was that the repo didn't immediately turn private when the person was notified.

For some people, yeah, this could be a career killer. For some other people, it might just precipitate a flight back to Moscow or Beijing or something.

reply
epistasis
2 hours ago
[-]
I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in

Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up the database password for the app.

It's time for orgs to audit and rotate secrets wherever they are stored in disk or in logs, and switch to SOPS or Vault or whatever to keep these out if plaintext except exactly when needed.

reply
mooreds
2 hours ago
[-]
Agreed. Static long lived credentials are real problems. Kudos for AWS and the other hyperscalers for building the tooling to move away from them. And providing some gentle and not-so-gentle nudges away from it too.

But not everyone is where they need to be. For instance, railway doesn't let you access AWS resources via roles/OIDC. I filed a ticket[0] but haven't seen movement.

0: https://station.railway.com/feedback/allow-for-integration-w...

reply
mixologic
1 hour ago
[-]
Heh, you mean the railway that was part of the whole "my production db got deleted in 9 seconds" story?

That company sounds a lot like one that doesn't focus on the right things.

reply
nrub
1 hour ago
[-]
I no longer keep my dotenv files in plaintext. I use `sops` to keep an encrypted env around and you can use tools like direnv to make them available to your shell while you're working. Obviously the LLM could print any of these secrets, but it's less likely. Additionally I find that at least claude seems to avoid reading the dotenv. And lastly, don't make any local secrets that important. Limited scope, dev accounts, etc.
reply
theozero
29 minutes ago
[-]
You might like varlock - it helps keep secrets out of plaintext by using plugins to pull from various backends (aws ssm, gcp, vault, 1pass, etc). Also has built in local encryption with shared team vaults coming soon.

Additionally provides pre commit scanning, log redaction, and much more.

reply
epistasis
1 hour ago
[-]
SOPS is exactly what I use too, and since it's so old I was using a planning session with an LLM to figure out if there was something more recent that might be more convenient. But Claude stuck with the SOPS rec! (Coupled with `age` for encryption, probably because I had shown an interest in that tool in a different session... memory poisoning is a huge problem I'm having with these tools right now too.)
reply
theozero
23 minutes ago
[-]
Get everything out of plaintext!

Varlock is a great and flexible way to do this.

reply
doctoboggan
1 hour ago
[-]
I've noticed recently that at least Claude will try its best not to read your env files. You really need to push it in the prompt if you want it to read and access your DB for example.
reply
epistasis
1 hour ago
[-]
We all have our own experiences with these probabilistic tools, but in my personal experience, two out of four my green-field LLM prototypes had early dev secrets in them, and Claude read all of them in both cases.

Here's one interaction, when I was planning through ways to finally get away from the dreaded .env file, I told Claude that it had already read my secrets, and it said:

> This is an important point and I want to be straight with you first.

> ## What already happened in this conversation

> Yes — the Explore agent read your .env and returned the full plaintext contents into the conversation, which means:

> 1. Sent to Anthropic's API — those credentials passed through Anthropic's servers as conversation context

> 2. Cached locally — Claude Code stores session transcripts; your secrets are likely sitting in ~/.claude/projects/ right now

> 3. In this context window — they're in active memory for this session

...

Which I already knew, but it was funny how it suddenly took it very seriously when told what it was doing.

Anything that's in your .bashrc, .zshrc, any environment variables in shells you provide to the LLM, all those are now in the training data of very large overvalued corporations that are desperate to increase their revenue and IPO very soon.

reply
philipwhiuk
2 hours ago
[-]
Sure but like, no AI was needed here. Regular human stupidity is still pretty potent.
reply
mooreds
1 hour ago
[-]
This is the thing that gets me about all the AI security pieces I read. Yes, AI can enable new attack vectors (prompt injection can be repeated N times when a human subject to the same messaging would bail).

But what AI really does is shine a spotlight on all the flaws folks like OWASP have been talking about for decades.

Secret rotation and short lived credentials don't require AI to implement, nor does their lack require AI to exploit.

reply
epistasis
52 minutes ago
[-]
Agreed 99%, but there is something a bit novel here, though: massive LLMs are really good at memorizing things, and there's now going to be all sorts of credentials memorized in Claude and ChatGPT, somewhere in the TB of floating point weights, and extracting such credentials and finding where they might be a new source of passwords and API keys to throw onto other huge password leaks. Or not. We'll see!

And in this particular case of CISA secrets, they are definitely stored inside of LLMs for future retrieval, even if no bad actors ever directly downloaded this obscure GitHub repo.

reply
cozzyd
1 hour ago
[-]
it seems crazy to "trust" an LLM with any secrets. Anyone running one as their normal user account with access to all files is playing with fire...
reply
epistasis
58 minutes ago
[-]
I don't think anybody actively trusts a hosted LLM with secrets. The problem is that they don't realize they have granted trust to the LLM.
reply
cozzyd
21 minutes ago
[-]
People happily run AI Desktop agents or whatever on their main user acounts commingled with ssh keys and who knows how many tokens.
reply
cyanydeez
1 hour ago
[-]
seems crazier someone would tie their entire development platform to a cloud run by business interests
reply
doctorpangloss
15 minutes ago
[-]
what exactly is the threat model?

user data is always paraphrased for training. what do you mean, not raise any flags?

look... Google is running your browser, Apple your messenger, Amazon your backend. They already have all these keys in the same way, are they misusing them? Why doens't it raise any flags then?

reply
giancarlostoro
1 hour ago
[-]
Claude told me to revoke an API key I accidentally pasted (was for a side project and I was getting it on its legs) just flat out did not want it. I have a feeling that if it needs something out of an env file it will grep for the specific line.
reply
epistasis
1 hour ago
[-]
Something pasted into the chat log by the user gets treated far differently from something that the agents discover and process on their own from disk.

During early stage dev Claude will happily gobble up API keys and DB passwords from .env files. Perhaps not such a big deal for early stage dev, but getting Claude to cough up precisely memorized tokens in the future by asking it to produce a "random" key of a certain sort will probably be an entertaining pastime for people in the future.

reply
cyanydeez
1 hour ago
[-]
most of that is context guard rails, and as context grows, they become guard jello until itll just do whatevers most immediate.
reply
yieldcrv
1 hour ago
[-]
probably but a ton of services have popped up in the last 6 months specifically to help mitigate that

localhost reading env from the cloud and other solutions

to me it suggested that I’m already late on that idea, but I can understand how that puts me deeper in a bubble than others

reply
epistasis
41 minutes ago
[-]
I've been using SOPS, which dates back to 2015. It's well tested, robust, supports a ton of great backends. What other solutions have you seen? I'm actively looking around in the space!
reply
yieldcrv
31 minutes ago
[-]
dotenv launched as2 (agentic secret storage), for example

advertising it directly in the command line for people that were already using the package

reply
debarshri
2 hours ago
[-]
They also uploaded sensitive docs in chatgpt [1]

[1] https://www.politico.com/news/2026/01/27/cisa-madhu-gottumuk...

reply
doodlebugging
17 minutes ago
[-]
Reading that article makes it look like Trump/Noem filled positions with foreign moles. One day the American people will have an accounting.
reply
bilekas
26 minutes ago
[-]
I would be fired for this. Probably not able to ask for a refenerce and forever be the butt of a joke between friends and colleagues.

Seems like no big deal for CISA. Defunded really paying off now.

reply
snihalani
10 minutes ago
[-]
Do they not believe in encrypted files?
reply
dcrazy
45 minutes ago
[-]
What makes this truly sad is that the federal government has had smartcard-based authentication (CAC) for decades. Yet because the public internet stack runs on passwords, so too does government infrastructure.
reply
exabrial
1 hour ago
[-]
Looks like someone needs to go take 27 training modules. That'll fix it.
reply
wnevets
1 hour ago
[-]
> but this administration clearly had no idea what they were getting themselves into and did not plan accordingly.
reply
ttul
1 hour ago
[-]
Yet another argument for the death of the API key. Replacements abound; let's get on with it.
reply
LelouBil
1 hour ago
[-]
Do you have any examples ?

It's the first time I hear about replacing API keys

reply
kittoes
15 minutes ago
[-]
This can be done in Azure using Entra (OAuth). I don't have API keys, or passwords of any kind, anywhere in the stack.

Infrastructure - https://dev.azure.com/byteterrace/Koholint/_git/Azure.Resour...

Server - https://dev.azure.com/byteterrace/Koholint/_git/Web.Function...

Client - https://dev.azure.com/byteterrace/Koholint/_git/Web.Portal

reply
jpalawaga
1 hour ago
[-]
OAuth with refresh tokens.

IAM roles/workload identity.

Even time-limited or signed JWT, though has a separate issues.

Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.

reply
jallmann
14 minutes ago
[-]
> OAuth with refresh tokens.

Then the LLM slurps up your refresh token. What's next?

reply
kittoes
2 minutes ago
[-]
Is that really a concern though in the same way API keys are? Since when do OAuth clients store refresh tokens in areas that LLMs regularly scan? API keys are truly passwords, while refresh tokens are exchanged for a password.

Sure, a leak would be bad but I'd argue that it's orders of magnitude less likely compared to the accepted norm.

reply
john_strinlai
46 seconds ago
[-]
it expires before it is found and used by others
reply
JoeBOFH
1 hour ago
[-]
So how would this help in this case? The oauth info would’ve just been in the csv or in someone’s env file.
reply
XorNot
48 minutes ago
[-]
At that point you've just reinvented Kerberos tickets really...
reply
dcrazy
44 minutes ago
[-]
It’s almost like Kerberos was designed and implemented for a reason!
reply
mooreds
1 hour ago
[-]
I wrote a post[0] a few years ago about how you basically get OAuth when you start layering security principles (rotation, time limits, central verification) onto API keys.

Turns out those standards writers knew something!

0: https://fusionauth.io/blog/securing-your-api

reply
leoooodias
1 hour ago
[-]
Workload identity. Whatever is using an API key could instead be given an identity, and narrow privileges assigned to that identity. API keys tend to be overscoped/overprivileged.
reply