Infisical
title: Infisical type: tool created: 2026-05-19 last_updated: 2026-05-19 related: ["Playradar", "radar/tools/Varlock", "radar/techniques/DockerSecuritySelfHosting"] sources: ["https://github.com/Infisical/infisical"] radar_quadrant: Tools radar_ring: Assess radar_position: inner
An open-source platform for centralised management of secrets, certificates, and privileged access across teams and infrastructure. Self-hostable alternative to HashiCorp Vault and AWS Secrets Manager, with a developer-focused interface.
Secrets management:
- Centralised dashboard across projects and environments (development, staging, production)
- Secret syncs to GitHub, Vercel, AWS, and other platforms
- Version history with point-in-time recovery
- Automated secret rotation for PostgreSQL, MySQL, and AWS IAM
- Dynamic secrets — ephemeral credentials generated on-demand
- Leak scanning across files, directories, and git repositories (140+ secret types)
- Kubernetes operator for workload secret injection with automatic deployment reloading
- Agent-based injection for applications without code modifications
Certificate management:
- Internal and external Certificate Authority support
- Certificate lifecycle management (API, ACME, EST enrollment)
- Syncs to AWS Certificate Manager and Azure Key Vault
- Expiration alerting
Access control:
- Role-based access with temporary access grants and approval workflows
- Multiple authentication methods: Kubernetes, GCP, Azure, AWS, OIDC
- Comprehensive audit logging
Available as Infisical Cloud (hosted) or self-hosted. Local development requires Git and Docker. TypeScript codebase (99.3%); 22,654+ commits; 513 releases. MIT licensed (enterprise features in ee/ directory use a separate licence).
Infisical covers the full secrets management surface — rotation, dynamic secrets, certificate management, SSH issuance — that HashiCorp Vault covers, under an open-source licence. AWS Secrets Manager covers a subset at higher per-secret cost with no self-hosting option.
Varlock integrates with Infisical as a secret provider for local development env configuration.
Infisical sits in the Assess ring of the Tools quadrant, at inner position. First studied via the GitHub repository on 2026-05-19; no direct Infisical use, though AWS Secrets Manager and Vault have been used previously. The project is mature (22k+ commits, 513 releases) and self-hostable. Inner position reflects a familiar problem space (secrets management), low conceptual friction given prior AWS Secrets Manager experience, and a clear trial path via self-hosted deployment on any Docker-capable machine. The remaining gate before Trial is a completed self-hosted deployment or migration of an existing project's secrets.
