CISA Contractor Disabled GitHub Secret Scanning Before Exposing Federal Cloud Keys

A CISA contractor disabled GitHub's default protection against publishing credentials before uploading a repository containing AWS GovCloud access tokens, plaintext passwords, and Kubernetes configuration files. The deliberate deactivation of secret-scanning—combined with naming the repository "Private-CISA"—suggests intentional publication rather than accidental oversight, raising questions about how federal contractor workflows escape detection.