US cyber agency CISA exposed reams of passwords and cloud keys to the open web

A public GitHub repository tied to a CISA contractor exposed plaintext passwords, cloud keys, and access tokens.

A security researcher said some of the credentials appeared to work for CISA and DHS systems.

The contractor did not respond to alerts, and the issue was later reported to authorities.

The lapse raised concerns that sensitive government cloud and internal systems could have been accessed without authorization.