Infisical is the open source security infrastructure platform that teams use for secrets, certificates, and privileged access management.
We're on a mission to make security tooling more accessible to everyone, not just security teams, and that means redesigning the entire developer experience from ground up.
Features
Secrets Management:
Centralize your application secrets and configuration across every environment, with versioning, rotation, and leak prevention built in.
Dashboard: Manage secrets across projects and environments (e.g. development, production, etc.) through a user-friendly interface.
Infisical Agent: Inject secrets into applications without modifying any code logic.
Honey Tokens: Plant decoy credentials alongside your real secrets that act as tripwires, instantly alerting your team the moment an attacker tries to use them.
Agent Vault: Broker AI agent access to external APIs so agents never hold real credentials. Outbound requests route through a proxy that injects secrets before forwarding, eliminating credential exfiltration risk from prompt injection.
Certificate Management
Run a complete private PKI: issue, manage, and monitor X.509 certificates from a centralized platform.
Internal CA: Create and manage a private
CA hierarchy directly within Infisical.
External CA: Integrate with third-party certificate authorities such as Let’s Encrypt, DigiCert, Microsoft AD CS, and more to leverage existing PKI infrastructure
or issue publicly trusted certificates.
Alerting: Configure alerting for expiring CA and end-entity certificates.
Code Signing: Sign software artifacts like containers, installers, and packages with managed code-signing certificates, central approval, and a full audit trail.
Infisical Key Management System (KMS):
Centrally manage cryptographic keys and use them to encrypt and decrypt data across your projects.
Cryptographic Keys: Centrally manage keys across projects through a user-friendly interface or via the API.
Contributing? Check out our guide to see how to get started.
Scan and prevent secret leaks
On top of managing secrets with Infisical, you can also scan for over 140+ secret types in your files, directories and git repositories.
To scan your full git history, run:
infisical scan --verbose
Install pre commit hook to scan each commit before you push to your repository
infisical scan install --pre-commit-hook
Learn about Infisical's code scanning feature here
Open-source vs. paid
This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license.
If you are interested in managed Infisical Cloud of self-hosted Enterprise Offering, take a look at our website or book a meeting with us.
Security
Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!
Infisical takes security issues very seriously. If you have any concerns about Infisical or believe you have uncovered a vulnerability, please report it privately through our vulnerability disclosure policy at https://infisical.com/vulnerability-disclosure. Scope, safe harbour and disclosure terms are all set out there. See also SECURITY.md.
Please report any security problems to us before disclosing them publicly. For compliance documentation and security questionnaires, use [email protected] instead.
Contributing
Whether it's big or small, we love contributions. Check out our guide to see how to get started.
Infisical 是一个开源安全平台，团队用它来集中管理密钥、证书和特权访问，内置同步、轮换和泄露防护功能。