How a CISA Contractor Left Federal Cloud Credentials Exposed on GitHub

A contractor for the cybersecurity agency disabled GitHub's built-in secret scanning—a tool that flags exposed passwords and access tokens—before uploading a repository containing AWS credentials and Kubernetes config files. The deliberate shutdown of this protection, paired with naming the repo "Private-CISA," suggests intentional publication rather than careless mistake, raising questions about federal contractor security practices.