Introduction
Infisical is the open source security infrastructure platform that teams use for secrets, certificates, privileged access management, and AI agent access.
We're on a mission to make security tooling more accessible to everyone, not just security teams, and that means redesigning the entire developer experience from ground up.
Features
Secrets Management
Centralize your application secrets and configuration across every environment, with versioning, rotation, and leak prevention built in.
- Dashboard: Manage secrets across projects and environments (e.g. development, production, etc.) through a user-friendly interface.
- Secret Syncs: Sync secrets to platforms like GitHub, Vercel, AWS, and use tools like Terraform, Ansible, and more.
- Secret versioning and Point-in-Time Recovery: Keep track of every secret and project state; roll back when needed.
- Secret Rotation: Rotate secrets at regular intervals for services like PostgreSQL, MySQL, AWS IAM, and more.
- Dynamic Secrets: Generate ephemeral secrets on-demand for services like PostgreSQL, MySQL, RabbitMQ, and more.
- Secret Sharing: Share a secret with anyone through a link that expires after a set time or number of views.
- Infisical Kubernetes Operator: Deliver secrets to your Kubernetes workloads and automatically reload deployments.
- Infisical Agent: Inject secrets into applications without modifying any code logic.
- Honey Tokens: Plant decoy credentials alongside your real secrets, and get an alert as soon as someone tries to use them.
Secret Scanning
Find secrets that were committed to your code, and block commits that add new ones.
Certificate Management
Issue, track, and renew X.509 certificates from internal or external CAs, and sign software artifacts.
- Internal CA: Create and manage a private CA hierarchy directly within Infisical.
- External CA: Integrate with third-party certificate authorities such as Let’s Encrypt, DigiCert, Microsoft AD CS, and more to leverage existing PKI infrastructure or issue publicly trusted certificates.
- Certificate Lifecycle Management: Create certificate profiles and policies to control how certificates are issued, including enrollment methods such as API, ACME, EST, or SCEP. Manage the full lifecycle from issuance to renewal and revocation with CRL and inventory tracking.
- Certificate Discovery: Scan your network to find certificates and track them in Infisical.
- Certificate Syncs: Sync certificates to external platforms like AWS Certificate Manager and Azure Key Vault.
- Alerting: Get notified when certificates are issued, renewed, revoked, or about to expire.
Infisical Key Management System (KMS)
Keep cryptographic keys in Infisical and use them through the API, so your applications never hold the keys.
Privileged Access Management (PAM)
Manage and secure access to critical infrastructure like databases and servers with policy-based controls, approvals, and full session visibility.
- Privileged Access Management: Decouple user identity from infrastructure credentials. Users authenticate with their SSO identity while Infisical brokers just-in-time access to resources like PostgreSQL, SSH servers, Kubernetes, Active Directory, and more.
- Session Recording: Capture and replay privileged sessions for audit and compliance.
- Credential Rotation: Rotate the passwords of your PAM accounts on a fixed schedule.
- Web Access: Connect from the browser to SSH servers, Windows servers over RDP, and databases such as PostgreSQL, MySQL, and Redis.
- Access Requests: Require approval before a member can use a sensitive account.
- Discovery: Scan Active Directory, databases, and Unix servers for privileged accounts and import them into PAM.
Agent Vault
Give AI agents access to the APIs they call, like LLM providers, GitHub, and Slack, without ever handing them a real credential.
- Agent Vault: Agents send requests through a proxy that attaches the real credential at the network boundary, so a prompt-injected agent has no secret to leak. Works with any agent, including Claude Code, Codex, OpenCode, and agents you build yourself.
- Access Bundles: Group the services an agent can call, each with its host, authentication method, and credential.
- Sessions: Issue time-bound grants scoped to one access bundle, from the CLI for cron jobs, containers, and CI, or from the API for each run of your own code.
- Session Logs: Keep an encrypted record of every request an agent makes, stored in your own Amazon S3 bucket.
General Platform
Capabilities that span every Infisical product.
- User Authentication: Sign users in with SSO or LDAP, and provision them with SCIM.
- Machine Authentication Methods: Authenticate machine identities with Infisical using a cloud-native or platform agnostic authentication method (Kubernetes Auth, GCP Auth, Azure Auth, AWS Auth, OIDC Auth, Universal Auth).
- Access Controls: Define advanced authorization controls for users and machine identities with RBAC, additional privileges, temporary access, access requests, approval workflows, and more.
Getting started
Check out the Quickstart Guides
Run Infisical locally
To set up and run Infisical locally, make sure you have Git and Docker installed on your system.
Linux/macOS:
git clone https://github.com/Infisical/infisical && cd "$(basename $_ .git)" && cp .env.example .env && docker compose -f docker-compose.prod.yml up
Windows (Command Prompt):
git clone https://github.com/Infisical/infisical && cd infisical && copy .env.example .env && docker compose -f docker-compose.prod.yml up
Once running, create an account at http://localhost:80.
Contributing? Check out our guide to see how to get started.
Scan and prevent secret leaks
With the Infisical CLI, you can scan for 140+ secret types in your files, directories, and git repositories.
To scan your full git history, run:
infisical scan --verbose
To block any commit that contains a secret, install a pre-commit hook:
infisical scan install --pre-commit-hook
To scan every push to your GitHub, GitLab, and Bitbucket repositories, see Secret Scanning.
Open-source vs. paid
This repo is available under the MIT expat license, with the exception of the ee directories, which contain premium enterprise features requiring an Infisical license.
If you are interested in managed Infisical Cloud or self-hosted Enterprise Offering, take a look at our website or book a meeting with us.
Security
Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!
Infisical takes security issues very seriously. If you have any concerns about Infisical or believe you have uncovered a vulnerability, please report it privately through our vulnerability disclosure policy at https://infisical.com/vulnerability-disclosure. Scope, safe harbour and disclosure terms are all set out there. See also SECURITY.md.
Please report any security problems to us before disclosing them publicly. For compliance documentation and security questionnaires, use [email protected] instead.
Contributing
Whether it's big or small, we love contributions. Check out our guide to see how to get started.
Not sure where to get started? You can:
- Join our community, and ask us any questions there.
We are hiring!
If you're reading this, there is a strong chance you like the products we created.
You might also make a great addition to our team. We're growing fast and would love for you to join us.
