It's hard to imagine a more embarrassing data leak. A contractor for the Cybersecurity and Infrastructure Security Agency — CISA, the federal government's own cyber defense watchdog — maintained a public GitHub repository called "Private-CISA." It was anything but private.

Active since November 2025 and discovered in May 2026, the repo contained administrative keys to three Amazon AWS GovCloud accounts, plaintext usernames and passwords for dozens of internal CISA systems, and detailed files showing exactly how the agency builds, tests, and deploys software. One security researcher who analyzed the contents called it "the worst leak that I've witnessed in my career."

The contractor appears to have used GitHub as a personal sync tool between work and home computers, committing files regularly for six months without realizing the world could see them. He'd also disabled GitHub's built-in secret scanning — the feature that warns you when you're about to publish passwords — meaning the platform tried to help and was told no thanks. Passwords followed an easily-guessed pattern: platform name plus the current year.

If this story sounds familiar in Colorado, it should.

We've Seen This Before — Closer to Home

In October 2024, the Colorado Secretary of State's Office inadvertently posted a spreadsheet to its public website containing voting system passwords. The passwords sat in a hidden tab — not encrypted, not behind a login, just a tab someone had clicked "hide" on. Anyone who downloaded the file and clicked "unhide" could see them.

The passwords, known as BIOS passwords, were one layer in a multi-step security process for the state's voting machines. But they'd been sitting on a publicly accessible website for months before someone noticed. An investigation later found that an employee had violated security protocols. No charges were filed.

Two government agencies. Two credential exposures. One at the state level, one at the federal level. Both discovered by outsiders. Both hiding in plain sight.

This Isn't a Technology Problem

The technical details in both cases are cringe-inducing: passwords in spreadsheets, keys in public GitHub repos, hidden tabs treated as security. But the real failure isn't technical. It's organizational.

In both incidents, a single person working alone made a workflow choice — sync files via GitHub, post a spreadsheet for convenience — and no system, process, or second set of eyes caught it. For months.

That's the uncomfortable truth these stories share: most security failures aren't sophisticated attacks. They're mundane governance gaps. Who has access to what? Where are credentials stored? What happens when someone takes a shortcut? If you can't answer those questions with confidence, the rest of your security stack is theater.

The sting is sharper because of who these organizations are. CISA is the agency that tells everyone else how to secure their systems. The Colorado Secretary of State's Office runs elections — the very system where public trust depends on airtight security. If they can't catch a public GitHub repo or a hidden spreadsheet tab, what chance does a small business have?

A better one than you might think — if you're honest about the gaps.

What This Means for Your Business

You're not CISA. You're not running elections. But you probably have your own version of this problem.

Small businesses rely on contractors, part-time IT staff, and third-party vendors who touch sensitive systems. One team member stores passwords in a spreadsheet. Someone's personal GitHub account has a key or token in it. A shared Google Drive folder contains credentials that shouldn't be there.

This isn't paranoia. These two incidents prove it's ordinary human behavior — busy people trying to make their workflows easier — that creates the biggest exposures. The question is whether your business has guardrails in place to catch it before someone else does.

Three Questions Worth Asking

If you run a business and technology isn't your full-time job, start here:

Do you know where your credentials live? Not just the ones you use — the ones your contractors, vendors, and part-time staff have. If the answer is "I'm not sure," that's worth fixing.

Do you have a process for when people leave? The CISA contractor's access lasted months. The Colorado spreadsheet sat unnoticed until an outside party flagged it. When someone stops working for you — employee or contractor — are their accounts deactivated the same day? If not, what's the gap?

Does anyone own this? In most small businesses, security isn't anyone's job. It drifts between whoever's available. That's how things fall through the cracks. Someone needs to own the answer to "are we doing this right?" — even if that person is external.

The Takeaway

Six months. That's how long CISA's secrets sat on public GitHub. Months for a hidden spreadsheet tab in Colorado. The federal government's cybersecurity agency and a state elections office — both trusted to protect some of our most sensitive infrastructure — couldn't protect their own credentials from basic human error.

The lesson isn't that government is incompetent or that security is hopeless. It's that governance isn't optional. If the people with access to your systems aren't following a clear, documented process for how credentials get handled and reviewed, you're one contractor oversight away from your own quiet disaster.

Talk to someone who does this for a living. Ask them to walk through your current setup — not to sell you something, but to tell you honestly where the gaps are. Sometimes the most valuable conversation is the one that finds the open door before someone else does.