Notifications
Clear all
Topic starter
03/06/2026 2:21 pm
TL;DR: A public GitHub repository exposed AWS GovCloud admin keys, plaintext passwords, and Kubernetes access data for months in a contractor-managed CISA environment, according to Akeyless and Brian Krebs. The incident shows that secret handling is still too often built around human failure instead of architectures that remove static credentials before they can leak.
NHIMG editorial — based on content published by Akeyless covering the CISA GitHub secret exposure: static credentials in a public repository and the case for brokered access
By the numbers:
- The repository had existed since November 2025, which means six months of continuous exposure.
- The exposed AWS keys remained valid for an additional 48 hours after the account was taken down.
Questions worth separating out
Q: How should teams handle privileged access when secrets can be copied into public repositories?
A: They should remove the durable secret from the workflow entirely and move to short-lived, identity-bound issuance.
Q: Why do static credentials create more risk than ephemeral access for cloud admins?
A: Static credentials create standing privilege, which means one leak can remain usable until someone finds and revokes it.
Q: What do security teams get wrong about secret scanning and push protection?
A: They often treat scanning as the primary control when it is really a last line of defence.
Practitioner guidance
- Replace durable admin keys with brokered access Issue privileged cloud access as short-lived sessions tied to identity and workload context.
- Eliminate plaintext credential exports Block workflows that allow passwords, kubeconfigs, or API keys to be exported into CSVs, notes, or browser-managed files.
- Audit repository guardrails and default settings Verify that push protection, secret scanning, and repository policy settings are enabled by default across all managed environments.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- The Akeyless-specific dynamic secret workflow for AWS GovCloud admin access and how it is configured.
- The zero-knowledge fragment architecture used for static secrets and how it changes recovery and disclosure assumptions.
- The Secure Remote Access session model for Kubernetes, SSH, and database access.
- The federal deployment posture described for GovCloud, including audit and cryptographic handling details.
👉 Read Akeyless's analysis of the CISA GitHub secret exposure and static credential risk →
Static secrets in a public repo: what IAM teams need to rethink?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
03/06/2026 2:27 pm
Static secret issuance is the broken assumption here. The architecture assumed that high-risk credentials could exist as durable values and still remain governable across contractor workflows. That assumption fails when secrets are copied into public repositories, browser exports, and local files because the credential itself becomes the breach path. The implication is not just better handling. It is that governance built around keeping static secrets safe is structurally outmatched by modern working patterns.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: Who is accountable when contractor-held credentials expose cloud and internal systems?
A: Accountability is shared, but the architecture owner must answer for making durable secrets the operating norm. Contractors can mishandle credentials, yet the deeper failure is issuing access in a form that is easy to copy, export, and reuse. Governance should assign responsibility to the programme that permitted plaintext privileged material to exist.
👉 Read our full editorial: Static secret architecture failed in the CISA GitHub exposure
