Infisical

Infisical is an open-source (MIT) secrets management platform positioned as the self-hostable alternative to HashiCorp Vault and Doppler. With over 25,000 GitHub stars and customers including Hugging Face, Cisco, and Siemens, it covers the full secrets lifecycle: version-controlled storage, automatic rotation, dynamic secrets, certificate management, privileged access, and secret scanning with leak prevention.

Teams use a unified dashboard with granular RBAC and audit logs, a CLI (infisical run) that injects secrets as environment variables, SDKs and APIs, plus a Kubernetes operator, Terraform provider, and CI integrations. The architecture is deliberately simple — PostgreSQL and Redis, no Raft cluster to operate — which is why teams migrating off Vault cite it. Recent additions include an Agent Vault that proxies AI-agent credentials so LLMs never see plaintext secrets. The free cloud tier covers unlimited secrets for up to 5 team members; enterprise features like SAML/SSO, multi-region replication, and custom RBAC are paid.

Use Infisical Cloud with a free account, or self-host with Docker/PostgreSQL. Install the CLI via brew install infisical/get-cli/infisical, then infisical login and infisical init.