{"slug": "infisical", "name": "Infisical", "category": "other", "category_name": "Other software", "description": "", "recommenders": 5, "commenters": 11, "warners": 2, "score": 3.818, "rising": -0.31, "first": "2026-01-21", "latest": "2026-10-12", "why": "I use Infisical (https://infisical.com/) which is free and self-hostable, and let's you inject secrets at runtime via their CLI. Very handy for small teams.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 4, "compare": 1, "warn": 2}, "spark": [0, 0, 0, 0, 0, 2, 1, 0, 1, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "I use Infisical (https://infisical.com/) which is free and self-hostable, and let's you inject secrets at runtime via their CLI. Very handy for small teams.", "kind": "", "icon": true, "domain": "infisical.com", "github_repo": null, "official_url": "https://infisical.com", "pricing": "", "aliases": ["Infisical"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 800814320, "item_id": 50050895, "url": "https://news.ycombinator.com/item?id=50050895", "by": "vmatsiiako", "date": "2026-10-12", "stance": "recommend", "quote": "You can use Infisical for both secrets, certs, and PAM", "excerpt": "You can use Infisical for both secrets, certs, and PAM: https://infisical.com", "context": "", "use_case": "secrets, certs, and PAM", "switched_from": "", "story": "HashiCorp archives the Boundary open source repo"}, {"id": 784397072, "item_id": 49024817, "url": "https://news.ycombinator.com/item?id=49024817", "by": "bstsb", "date": "2026-07-23", "stance": "recommend", "quote": "brilliant self-hosted offering, i love their CLI and it works well with CI pipelines", "excerpt": "+1 on infisical. brilliant self-hosted offering, i love their CLI and it works well with CI pipelines", "context": "", "use_case": "Secrets management for CI", "switched_from": "", "story": "Show HN: OneCLI \u2013 OSS credential gateway that keeps secrets out of AI agents"}, {"id": 771946960, "item_id": 48246685, "url": "https://news.ycombinator.com/item?id=48246685", "by": "mindwok", "date": "2026-05-23", "stance": "recommend", "quote": "I use Infisical (https://infisical.com/) which is free and self-hostable, and let's you inject secrets at runtime via their CLI. Very handy for small teams.", "excerpt": "IMO env files are a bit of an anti-pattern, env vars should be set outside the context of your app so that your app doesn't need to care where they come from, it just uses standard env var APIs to read them. This means developers can choose how they load them and what tools they use to do so. With that said, the problem still exists just one layer higher. If they are secrets, I use Infisical (https://infisical.com/) ", "context": "", "use_case": "sharing secrets in small teams", "switched_from": "", "story": "Ask HN: How do small teams securely share env files?"}, {"id": 766604097, "item_id": 47912756, "url": "https://news.ycombinator.com/item?id=47912756", "by": "oddurmagnusson", "date": "2026-04-26", "stance": "recommend", "quote": "For secrets, I self-host Infisical on the box", "excerpt": "Service discovery is basically just Docker's internal DNS. Caddy-docker-proxy can use it to find healthy upstreams. For secrets, I self-host Infisical on the box -- easy to plug in whatever secret manager, should make it pair nicely with https://github.com/tellerops/teller or something similar Had no problems with Hertzner so far, just enjoying the raw CPU power of bare metal. The plan is to roll out more boxes acros", "context": "", "use_case": "Secret management", "switched_from": "", "story": "Dear friend, you have built a Kubernetes (2024)"}, {"id": 765973232, "item_id": 47873327, "url": "https://news.ycombinator.com/item?id=47873327", "by": "dandaka", "date": "2026-04-23", "stance": "recommend", "quote": "I like the UI of secret management there.", "excerpt": "Can I use Infisical cloud vaults with Agent Vault? I like the UI of secret management there. I like that I can manage secrets from many environments in a single place.", "context": "", "use_case": "secret management across environments", "switched_from": "", "story": "Show HN: Agent Vault \u2013 A HTTP credential proxy and vault for AI agents"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 787037554, "item_id": 49189847, "url": "https://news.ycombinator.com/item?id=49189847", "by": "cvince", "date": "2026-08-05", "stance": "warn", "quote": "IMO they just didn't try hard enough", "excerpt": "Absolutely. Doppler custodies the credentials entirely themselves, and Infisical ditched zero-trust earlier on citing complexity and UX concerns - IMO they just didn't try hard enough ;) I also decided to embrace .env because that's how humans (and apparently agents -- for now) like to work when building stuff. Except Capy is the only solution I know of that allows you to cryptographically revoke access to those .env", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Capy \u2013 A Git-style platform for managing your team's secrets"}, {"id": 754223218, "item_id": 47138951, "url": "https://news.ycombinator.com/item?id=47138951", "by": "secr", "date": "2026-02-24", "stance": "warn", "quote": "they're still priced for enterprise", "excerpt": "This is a great breakdown. Particularly the point about Docker ARG/ENV baking secrets into images \u2014 that catches so many teams. On the \"read from secret managers directly\" option \u2014 that's the ideal but the friction is what kills adoption. Most small teams look at Vault's setup guide and go back to .env files. Doppler and Infisical lowered that bar but they're still priced for enterprise ($18/user/mo for Doppler's tea", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}]}], "who": [], "tags": [], "use_cases": ["secrets, certs, and pam", "secrets management", "secrets management for ci", "sharing secrets in small teams", "secret management", "secret management across environments"], "compared": [{"slug": "doppler", "name": "Doppler", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "tailscale", "name": "Tailscale", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "caddy", "name": "Caddy", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "hashicorp-vault", "name": "HashiCorp Vault", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 786174768, "item_id": 49135923, "url": "https://news.ycombinator.com/item?id=49135923", "by": "jakehulberg23", "date": "2026-08-01", "stance": "recommend", "quote": "There's a solution for this in Infisical!", "excerpt": "There's a solution for this in Infisical! It's called secrets brokering and is built into the Infisical CLI: The Infisical agent proxy. Using this, your agent can use secrets without ever being able to fetch them back since they are injected into upstream requests. You can use this for local coding agents like Claude Code or Codex, and also have a standalone proxy with a separate machine identity for longer running a", "context": "", "use_case": "secrets brokering for AI agents", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 784401568, "item_id": 49025098, "url": "https://news.ycombinator.com/item?id=49025098", "by": "rahulr0609", "date": "2026-07-23", "stance": "recommend", "quote": "+1 to Infisical.", "excerpt": "+1 to Infisical. We added Hashicorp Vault support here: https://github.com/Infisical/agent-vault/pull/256", "context": "works on Infisical", "use_case": "secrets management for agents", "switched_from": "", "story": "Show HN: OneCLI \u2013 OSS credential gateway that keeps secrets out of AI agents"}, {"id": 767696832, "item_id": 47981052, "url": "https://news.ycombinator.com/item?id=47981052", "by": "austint213", "date": "2026-05-01", "stance": "recommend", "quote": "Infisical is the all-in-one platform to securely manage application secrets", "excerpt": "Infisical | Full-Time | Senior Fullstack Engineers | Remote, Americas (https://infisical.com/) Secure Secrets, Certificates, and AI Agents. Infisical is the all-in-one platform to securely manage application secrets, certificates, SSH keys, and privileged access across classic and AI infrastructure \u2014 trusted by engineering teams at LG, NVIDIA, Hugging Face, and thousands of teams worldwide. * Apply here: https://infi", "context": "Hiring for Infisical", "use_case": "Secrets and certificate management", "switched_from": "", "story": "Ask HN: Who is hiring? (May 2026)"}, {"id": 766327600, "item_id": 47895475, "url": "https://news.ycombinator.com/item?id=47895475", "by": "dangtony98", "date": "2026-04-24", "stance": "recommend", "quote": "this makes much more sense for us at Infisical to work on", "excerpt": "Hey! Yeah I think there's overlapping functionality for sure, and you're spot on on people looking at it from different angles. The \"connectors angle\" is something we thought about as well and we built a whole product line around that called Agent Sentinel (I'll link that below). We weren't convinced, however, that enterprises were ready for this and instead took it back to our infra roots (Infisical is a security in", "context": "works at Infisical", "use_case": "", "switched_from": "", "story": "Show HN: Agent Vault \u2013 A HTTP credential proxy and vault for AI agents"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49023427", "title": "Show HN: OneCLI \u2013 OSS credential gateway that keeps secrets out of AI agents", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=47885012", "title": "Dear friend, you have built a Kubernetes (2024)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=47865822", "title": "Show HN: Agent Vault \u2013 A HTTP credential proxy and vault for AI agents", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50049498", "title": "HashiCorp archives the Boundary open source repo", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49363710", "title": "Launch HN: OneCLI (YC S26) \u2013 OSS sandboxed agent harness for teams", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49354880", "title": "item 49354880", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"neutral": 1}, "2026-02": {"warn": 1}, "2026-03": {}, "2026-04": {"compare": 1, "recommend": 2, "neutral": 1}, "2026-05": {"recommend": 1}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {"warn": 1, "neutral": 2}, "2026-09": {}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 800814320, "item_id": 50050895, "url": "https://news.ycombinator.com/item?id=50050895", "by": "vmatsiiako", "date": "2026-10-12", "stance": "recommend", "quote": "You can use Infisical for both secrets, certs, and PAM", "excerpt": "You can use Infisical for both secrets, certs, and PAM: https://infisical.com", "context": "", "use_case": "secrets, certs, and PAM", "switched_from": "", "story": "HashiCorp archives the Boundary open source repo"}, {"id": 789939104, "item_id": 49371194, "url": "https://news.ycombinator.com/item?id=49371194", "by": "sagarpatil", "date": "2026-08-19", "stance": "neutral", "quote": "Are you aware of https://infisical.com/docs/documentation/platform/agent-proxy/overview ?", "excerpt": "Are you aware of https://infisical.com/docs/documentation/platform/agent-proxy/overview ?", "context": "", "use_case": "", "switched_from": "", "story": "Launch HN: OneCLI (YC S26) \u2013 OSS sandboxed agent harness for teams"}, {"id": 789678097, "item_id": 49354881, "url": "https://news.ycombinator.com/item?id=49354881", "by": "xinbenlv", "date": "2026-08-18", "stance": "neutral", "quote": "I have used 1Password and Infisical", "excerpt": "I have something embarrassing to share: my computer was compromised, and I don\u2019t know whether my keys were leaked. It was an old computer that I had stopped using and let my family use. Most of the sensitive things had already been cleared, but still, when they told me they had \u201cmistakenly run some scripts, only to realize they might not be safe,\u201d I was like... damn... What followed that bad news was what you can ima", "context": "", "use_case": "Secrets management", "switched_from": "", "story": null}, {"id": 787037554, "item_id": 49189847, "url": "https://news.ycombinator.com/item?id=49189847", "by": "cvince", "date": "2026-08-05", "stance": "warn", "quote": "IMO they just didn't try hard enough", "excerpt": "Absolutely. Doppler custodies the credentials entirely themselves, and Infisical ditched zero-trust earlier on citing complexity and UX concerns - IMO they just didn't try hard enough ;) I also decided to embrace .env because that's how humans (and apparently agents -- for now) like to work when building stuff. Except Capy is the only solution I know of that allows you to cryptographically revoke access to those .env", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Capy \u2013 A Git-style platform for managing your team's secrets"}, {"id": 784397072, "item_id": 49024817, "url": "https://news.ycombinator.com/item?id=49024817", "by": "bstsb", "date": "2026-07-23", "stance": "recommend", "quote": "brilliant self-hosted offering, i love their CLI and it works well with CI pipelines", "excerpt": "+1 on infisical. brilliant self-hosted offering, i love their CLI and it works well with CI pipelines", "context": "", "use_case": "Secrets management for CI", "switched_from": "", "story": "Show HN: OneCLI \u2013 OSS credential gateway that keeps secrets out of AI agents"}, {"id": 771946960, "item_id": 48246685, "url": "https://news.ycombinator.com/item?id=48246685", "by": "mindwok", "date": "2026-05-23", "stance": "recommend", "quote": "I use Infisical (https://infisical.com/) which is free and self-hostable, and let's you inject secrets at runtime via their CLI. Very handy for small teams.", "excerpt": "IMO env files are a bit of an anti-pattern, env vars should be set outside the context of your app so that your app doesn't need to care where they come from, it just uses standard env var APIs to read them. This means developers can choose how they load them and what tools they use to do so. With that said, the problem still exists just one layer higher. If they are secrets, I use Infisical (https://infisical.com/) ", "context": "", "use_case": "sharing secrets in small teams", "switched_from": "", "story": "Ask HN: How do small teams securely share env files?"}, {"id": 766604097, "item_id": 47912756, "url": "https://news.ycombinator.com/item?id=47912756", "by": "oddurmagnusson", "date": "2026-04-26", "stance": "recommend", "quote": "For secrets, I self-host Infisical on the box", "excerpt": "Service discovery is basically just Docker's internal DNS. Caddy-docker-proxy can use it to find healthy upstreams. For secrets, I self-host Infisical on the box -- easy to plug in whatever secret manager, should make it pair nicely with https://github.com/tellerops/teller or something similar Had no problems with Hertzner so far, just enjoying the raw CPU power of bare metal. The plan is to roll out more boxes acros", "context": "", "use_case": "Secret management", "switched_from": "", "story": "Dear friend, you have built a Kubernetes (2024)"}, {"id": 766600578, "item_id": 47912536, "url": "https://news.ycombinator.com/item?id=47912536", "by": "subhobroto", "date": "2026-04-26", "stance": "neutral", "quote": "Crap you use Infisical. No shade", "excerpt": "> found myself rolling out Yoink - using Tailscale SSH is brilliant - using caddy-docker-proxy for ingress is brilliant What do you use for: - service discovery - secret store (EDIT: Crap you use Infisical. No shade, I just have this horrible foreboding it will end up like Hashicorp. I use Conjur Secretless Broker but am tracking: https://news.ycombinator.com/item?id=47903690) - backing up and restoring state like in", "context": "", "use_case": "", "switched_from": "", "story": "Dear friend, you have built a Kubernetes (2024)"}, {"id": 765973232, "item_id": 47873327, "url": "https://news.ycombinator.com/item?id=47873327", "by": "dandaka", "date": "2026-04-23", "stance": "recommend", "quote": "I like the UI of secret management there.", "excerpt": "Can I use Infisical cloud vaults with Agent Vault? I like the UI of secret management there. I like that I can manage secrets from many environments in a single place.", "context": "", "use_case": "secret management across environments", "switched_from": "", "story": "Show HN: Agent Vault \u2013 A HTTP credential proxy and vault for AI agents"}, {"id": 763322368, "item_id": 47707648, "url": "https://news.ycombinator.com/item?id=47707648", "by": "mc-serious", "date": "2026-04-09", "stance": "compare", "quote": "how does infisical differentiate?", "excerpt": "Definitely a worthwhile problem to be solved! There's similar approaches by Kontext and OneCLI - how does infisical differentiate? https://github.com/kontext-dev/kontext-cli https://github.com/onecli/onecli", "context": "", "use_case": "", "switched_from": "", "story": "Coding Agents Are Reading Your .env"}, {"id": 754223218, "item_id": 47138951, "url": "https://news.ycombinator.com/item?id=47138951", "by": "secr", "date": "2026-02-24", "stance": "warn", "quote": "they're still priced for enterprise", "excerpt": "This is a great breakdown. Particularly the point about Docker ARG/ENV baking secrets into images \u2014 that catches so many teams. On the \"read from secret managers directly\" option \u2014 that's the ideal but the friction is what kills adoption. Most small teams look at Vault's setup guide and go back to .env files. Doppler and Infisical lowered that bar but they're still priced for enterprise ($18/user/mo for Doppler's tea", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 747456864, "item_id": 46716054, "url": "https://news.ycombinator.com/item?id=46716054", "by": "xinbenlv", "date": "2026-01-21", "stance": "neutral", "quote": "We use infiscial and other mechanism", "excerpt": "We use infiscial and other mechanism but hey, wouldn't it be nice to have one less square inch of attack surface?", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env"}]}