♾ Infisical is the open-source secret management platform: Sync secrets across your team/infrastructure, prevent secret leaks, and manage internal PKI
The open-source secret management platform: Sync secrets/configs across your team/infrastructure and prevent secret leaks.
Slack | Infisical Cloud | Self-Hosting | Docs | Website | Hiring (Remote/SF)
Introduction
Infisical is the open source secret management platform that teams use to centralize their application configuration and secrets like API keys and database credentials as well as manage their internal PKI.
We’re on a mission to make security tooling more accessible to everyone, not just security teams, and that means redesigning the entire developer experience from ground up.
Features
Secrets Management:
- Dashboard: Manage secrets across projects and environments (e.g. development, production, etc.) through a user-friendly interface.
- Native Integrations: Sync secrets to platforms like GitHub, Vercel, AWS, and use tools like Terraform, Ansible, and more.
- Secret versioning and Point-in-Time Recovery: Keep track of every secret and project state; roll back when needed.
- Secret Rotation: Rotate secrets at regular intervals for services like PostgreSQL, MySQL, AWS IAM, and more.
- Dynamic Secrets: Generate ephemeral secrets on-demand for services like PostgreSQL, MySQL, RabbitMQ, and more.
- Secret Scanning and Leak Prevention: Prevent secrets from leaking to git.
- Infisical Kubernetes Operator: Deliver secrets to your Kubernetes workloads and automatically reload deployments.
- Infisical Agent: Inject secrets into applications without modifying any code logic.
Internal PKI:
- Private Certificate Authority: Create CA hierarchies, configure certificate templates for policy enforcement, and start issuing X.509 certificates.
- Certificate Management: Manage the certificate lifecycle from issuance to revocation with support for CRL.
- Alerting: Configure alerting for expiring CA and end-entity certificates.
- Infisical PKI Issuer for Kubernetes: Deliver TLS certificates to your Kubernetes workloads with automatic renewal.
- Enrollment over Secure Transport: Enroll and manage certificates via EST protocol.
Key Management (KMS):
- Cryptograhic Keys: Centrally manage keys across projects through a user-friendly interface or via the API.
- Encrypt and Decrypt Data: Use symmetric keys to encrypt and decrypt data.
General Platform:
- Authentication Methods: Authenticate machine identities with Infisical using a cloud-native or platform agnostic authentication method (Kubernetes Auth, GCP Auth, Azure Auth, AWS Auth, OIDC Auth, Universal Auth).
- Access Controls: Define advanced authorization controls for users and machine identities with RBAC, additional privileges, temporary access, access requests, approval workflows, and more.
- Audit logs: Track every action taken on the platform.
- Self-hosting: Deploy Infisical on-prem or cloud with ease; keep data on your own infrastructure.
- Infisical SDK: Interact with Infisical via client SDKs (Node, Python, Go, Ruby, Java, .NET)
- Infisical CLI: Interact with Infisical via CLI; useful for injecting secrets into local development and CI/CD pipelines.
- Infisical API: Interact with Infisical via API.
Getting started
Check out the Quickstart Guides
| Use Infisical Cloud | Deploy Infisical on premise |
|---|---|
| The fastest and most reliable way to get started with Infisical is signing up for free to Infisical Cloud. |
View all deployment options |
Run Infisical locally
To set up and run Infisical locally, make sure you have Git and Docker installed on your system. Then run the command for your system:
Linux/macOS:
git clone https://github.com/Infisical/infisical && cd "$(basename $_ .git)" && cp .env.example .env && docker compose -f docker-compose.prod.yml up
Windows Command Prompt:
git clone https://github.com/Infisical/infisical && cd infisical && copy .env.example .env && docker compose -f docker-compose.prod.yml up
Create an account at http://localhost:80
Scan and prevent secret leaks
On top managing secrets with Infisical, you can also scan for over 140+ secret types in your files, directories and git repositories.
To scan your full git history, run:
infisical scan --verbose
Install pre commit hook to scan each commit before you push to your repository
infisical scan install --pre-commit-hook
Lean about Infisical’s code scanning feature here
Open-source vs. paid
This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license.
If you are interested in managed Infisical Cloud of self-hosted Enterprise Offering, take a look at our website or book a meeting with us.
Security
Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!
Infisical takes security issues very seriously. If you have any concerns about Infisical or believe you have uncovered a vulnerability, please get in touch via the e-mail address [email protected]. In the message, try to provide a description of the issue and ideally a way of reproducing it. The security team will get back to you as soon as possible.
Note that this security address should be used only for undisclosed vulnerabilities. Please report any security problems to us before disclosing it publicly.
Contributing
Whether it’s big or small, we love contributions. Check out our guide to see how to get started.
Not sure where to get started? You can:
- Join our Slack, and ask us any questions there.