Feed aggregator

You can now go "hooligan" in the McDonald's drive-through line.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a recent data leak in which a contractor published dozens of internal CISA credentials — including AWS Govcloud keys — in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency’s initial response provide important lessons that all security teams should absorb.

On May 15, 2026, the security firm GitGuardian asked for help in notifying CISA about the existence of a public GitHub repository called “Private CISA” that included 844 MB of sensitive CISA-related data. One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers. Another file — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems.

CISA quickly acknowledged our initial alert, but took more than 48 hours to invalidate the AWS keys and many other important secrets leaked in the GitHub repo. In its report on the data leak, CISA said the complexities of the agency’s systems and interconnections with federal and industry partners caused its key rotation to take longer than anticipated.

“Drawing on this experience, CISA encourages others to maintain mature and well-tested key management capabilities,” the report notes.

CISA also admitted it can do better when it comes to responding to security incident notifications from external parties. The postmortem stresses that clear and distinct reporting channels are essential to ensure that incidents affecting the organization itself are handled differently from those involving its products or customers.

“In CISA’s case, these channels were not well defined, leading the security researcher to try multiple avenues – including emailing the contractor, submitting through CISA’s vulnerability disclosure platform (which is intended for vulnerabilities impacting the broader cybersecurity community), and ultimately involving a reporter,” reads the analysis written by Preston Werntz and Brad Libbey, the acting chief information officer and acting chief information security officer at CISA, respectively.

CISA said it is refining its reporting channels to make them easier and faster for researchers. “Additionally, while many researchers rely on the security.txt file, organizations can ensure clarity by publishing reporting instructions in multiple prominent locations,” the CISA authors wrote.

Guillaume Valadon, the GitGuardian researcher who first contacted KrebsOnSecurity about the exposed CISA credentials, said CISA ignored nine automated alerts about the exposed credentials prior to our notification on May 15. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures.

“Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure,” Valadon wrote in an analysis of CISA’s report. “Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat. Publish a security.txt, but do not stop there. Put reporting instructions in several prominent places, and make sure a report about your own infrastructure does not land in a product-bug queue.”

The report’s authors also emphasized the importance of continuously scanning public code repositories like GitHub for exposed secrets, and said CISA has since rotated all secrets and created an action plan to improve management of developer secrets and to better monitor for them going forward.

The report notes that while CISA had developed a playbook for responding to cybersecurity incidents, that playbook somehow didn’t include what to do in situations involving GitHub or other cloud services. Valadon said the report validates the need to scan continuously — not just quarterly — for exposed secrets.

“The Private-CISA repository sat public for six months,” Valadon wrote. “Continuous monitoring of public GitHub surfaced it. Comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building.”

CISA gave itself passing grades on several areas of security preparedness that it said helped the agency gauge the scope and impact of the exposed secrets, including enhanced logging capabilities, and the adoption of zero-trust principles in both its production and development systems. CISA said those detailed logs allowed it to show that no customer or mission data was exposed, and that the leaked credentials were not used outside of CISA’s environments. The agency said the contractor who exposed the secrets had their system access revoked.

Valadon reckons the biggest takeaway is the CISA postmortem itself, and praised the agency for being transparent about what worked and what didn’t.

“To my knowledge, it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers,” Valadon wrote. “That is exactly the incident communication we should expect from every organization.”

It's next to impossible to attend high school or college without a laptop. Here are my favorite laptops that I've tested and reviewed for student budgets.

AI tools can make Photoshop less overwhelming.

Article URL: https://taonaw.com/2026/07/10/auth-and-curl.html

Comments URL: https://news.ycombinator.com/item?id=48893620

Points: 1

# Comments: 0

Article URL: https://aras-p.info/blog/2026/06/28/Joys-of-cancelling-a-TBB-task-group/

Comments URL: https://news.ycombinator.com/item?id=48893613

Points: 1

# Comments: 0

Hello HN!

As part of our work at Kenobi[0], I used Codex to analyse an HTTP archive (HAR) for a website I was trying to see if I could use programatically, i.e. by exposing its underlying / undocumented API. That approach worked much better than I expected, so I started looking for a way to do this easily for other websites.

I couldn't find exactly what I wanted, so we decided to build Harpist -- a product in two parts: i. A Chrome extension, that allows you to record HAR files and view generated documentation; and ii. A CLI that can be used by agents to refine these HAR files and create oRPC contracts, documentation, and allow you to replay HTTP requests.

There's an agent skill that lets you use Claude or Codex to manage all of the refinement and CLI usage, so right now the workflow is as follows:

1. Open the Chrome extension and record yourself using a website (the parts you'd want to automate).

2. Tell your agent to "use Harpist to refine my latest recording".

3. When it's done, the extension lets you view documentation for the discovered endpoints.

4. Replay the endpoints and view captured auth data in the CLI yourself, or just...

5. Ask your agent to do something for you on one of the website's you've captured and processed using Harpist.

It's all open source (MIT licensed)[1], and under the hood it uses oRPC to create TypeScript-compatible API contracts, but I've mostly been focussing on the documentation for now which just uses the oRPC Scalar integration[2] to generate OpenAPI-looking docs.

I'm keen to learn what other people are doing to discover and automate web workflows at the moment, and what kind of things people _wish_ existed too.

[0] - https://kenobi.ai

[1] - https://github.com/kenobi-ai/harpist

[2] - http://orpc.dev/docs/openapi/scalar

Comments URL: https://news.ycombinator.com/item?id=48893610

Points: 1

# Comments: 0

well from thousands of ai written lines of code to some system specific moves that might break tons of installs where people have customized things quite a bit might break, or am i over thinking this?

Comments URL: https://news.ycombinator.com/item?id=48893609

Points: 1

# Comments: 0

Article URL: https://github.com/openai/codex/issues/32806

Comments URL: https://news.ycombinator.com/item?id=48893607

Points: 1

# Comments: 0

Article URL: https://www.irishtimes.com/crime-law/courts/2026/06/15/finnish-company-sues-dell-over-70m-price-increase-for-data-centre-servers/

Comments URL: https://news.ycombinator.com/item?id=48893606

Points: 1

# Comments: 0

Article URL: https://pitchbook.com/news/reports/q2-2026-us-pe-breakdown

Comments URL: https://news.ycombinator.com/item?id=48893582

Points: 1

# Comments: 0

Article URL: https://alec.is/posts/llm-honeypots-the-perfect-use-for-llms/

Comments URL: https://news.ycombinator.com/item?id=48893572

Points: 1

# Comments: 0

Article URL: https://www.business-standard.com/technology/tech-news/zhipu-founder-backs-open-source-ai-as-global-security-debate-intensifies-126071200342_1.html

Comments URL: https://news.ycombinator.com/item?id=48893569

Points: 1

# Comments: 0

Article URL: https://www.yacnews.com/sysdig-documents-the-first-ransomware-attack-run-end-to-end-by-an-ai-agent/

Comments URL: https://news.ycombinator.com/item?id=48893568

Points: 1

# Comments: 0

I created an app that compares real-time prices and wait times across Uber, Lyft, Waymo, Tesla Robotaxi, Curb, and Empower. It shows you all ride options in one list, then once you’re ready to book, it deeplinks you to the provider’s app with the route pre-filled.

I reverse-engineered ride-hailing mobile apps to understand how they fetch prices from their servers. You sign in to my app with your ride-hailing accounts, and then my app requests live prices from the same APIs that ride-hailing apps use. Importantly, my app is built using an on-device approach: the app on your phone stores authentication tokens locally and sends network requests directly to each ride-hailing company’s servers. This keeps your accounts private. I wrote a blog post showing network requests sent by my app, which you can verify yourself: https://blog.hackney.app/p/how-hackney-works

This seems like an obvious app. Why doesn’t it already exist? That’s because most ride-hailing companies don’t offer public APIs for prices and wait times. Uber does offer one, but they prohibit using it for price comparison. When someone built a comparison app using the official API, Uber terminated their API access (https://www.benedelman.org/news-053116). There are apps today that don’t use official APIs, but they run your account tokens through their servers and send price requests server-side.

To integrate a ride-hailing provider, my app sends network requests for sign-in, token refresh, ride prices, and ride history (to power a feature that shows you unified ride history across apps and how much you’ve saved on each ride). Some ride-hailing apps implement certificate pinning to prevent you from viewing their network requests, and some communicate with their server using Protobuf, a data format that doesn’t include the original field names. Building an app using this approach is technically complex, but it makes possible all sorts of useful products that couldn’t otherwise exist.

The app is completely free. In the future, I may monetize through a subscription or partnerships with ride-hailing companies. I’d love to hear your feedback. You can download it today.

iOS: https://apps.apple.com/us/app/hackney-compare-rideshares/id6...

Android: https://play.google.com/store/apps/details?id=app.hackney

Comments URL: https://news.ycombinator.com/item?id=48893550

Points: 1

# Comments: 0

Article URL: https://www.wespiser.com/posts/2026-07-13-salience-driven-development.html

Comments URL: https://news.ycombinator.com/item?id=48893546

Points: 1

# Comments: 0

Article URL: https://github.com/Dawnfz-Lenfeng/tikos

Comments URL: https://news.ycombinator.com/item?id=48893478

Points: 1

# Comments: 0

Article URL: https://doerpmund.com/musings/death-of-open-channels

Comments URL: https://news.ycombinator.com/item?id=48893461

Points: 1

# Comments: 0

Article URL: https://blog.cloudflare.com/introducing-precursor/

Comments URL: https://news.ycombinator.com/item?id=48893446

Points: 3

# Comments: 0

Article URL: https://www.bbc.com/news/articles/cg53l737v1qo

Comments URL: https://news.ycombinator.com/item?id=48893425

Points: 1

# Comments: 0