Infisical manages application secrets with an emphasis on being pleasant to use. That sounds like a minor concern until you consider that the main competitor to a secrets manager is a .env file, and a tool people find awkward loses to the .env file every time.

The model

Secrets are organised by project and environment, so the same key has different values in development, staging, and production. Access is controlled per user and per service token.

Applications get secrets in whichever way fits:

# Inject into a process environment
infisical run -- npm start

# Fetch into a file
infisical export --format=dotenv > .env

The run form is the better pattern, because secrets exist only in the process environment rather than being written to disk where they can be committed by accident.

Secret scanning

Infisical includes scanning to detect credentials in code, and can run as a pre-commit hook.

This addresses the failure that actually happens. Secrets rarely leak through a compromised secrets manager; they leak because someone committed a key and it sat in Git history for a year. Catching it before the commit is worth more than any amount of storage encryption.

Gitleaks does the same job as a standalone tool if you do not want the whole platform.

Rotation and versioning

Secrets are versioned, so you can see what changed and roll back. Rotation is supported for several integrations, with the usual caveat that rotation only helps if the application picks up the new value.

Against OpenBao

Infisical for application configuration secrets, with a good interface and low operational overhead. This is what most self-hosters and small teams actually need.

OpenBao for dynamic credentials, encryption as a service, an internal certificate authority, and detailed audit requirements. More capable and considerably more to operate.

Starting with Infisical and moving later is a reasonable path; starting with OpenBao because it is more powerful and then not using it is the common mistake.

Running it

Docker Compose with PostgreSQL and Redis. Put it behind a reverse proxy with TLS, since it is by definition holding everything worth stealing.

License

Infisical is released under the MIT License, with some features under a separate enterprise licence.

Links

• Website
• Repository