61–70 of 124 posts
Earlier quoted context omitted.
You open-sourced your code - isn't this scrutiny exactly what you would want to achieve? Alternatively, I would expect these reports to be reported via your issues tracker.
Yup! We appreciate feedback we can get across all aspects including security but employ a security policy of reporting any security concerns via email - this is pretty standard practice we've seen.
Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…
Thank you for pointing this out! Happy to take a look and discuss what you're building! I agree with some of these tips, but I think it's best to report them privately to team@infisical.com. We can then see with our team if these points are correct. Otherwise, this goes against responsible practices of security notifications and sounds more like an ad for your project.
Earlier quoted context omitted.
Yup! We appreciate feedback we can get across all aspects including security but employ a security policy of reporting any security concerns via email - this is pretty standard practice we've seen.
> employ a security policy of reporting any security concerns via email You don't have a security.txt, https://infisical.com/docs/security/overview doesn't mention it and it's not on your FAQ, so I don't blame ianpurton for not finding it. You have a 'Report a vulnerability' issue template on GitHub ( https://github.com/Infisical/infisical/security/advisories/n... ) but then your readme points to a security policy wh…
There's also an issue template for reporting vulnerabilities as well as you mentioned.
That said, we'll add info to the security page in our docs to contact us regarding vulnerabilities.
Thanks!
TIL that systemd has a credentials component: https://systemd.io/CREDENTIALS/
Earlier quoted context omitted.
Yup! We appreciate feedback we can get across all aspects including security but employ a security policy of reporting any security concerns via email - this is pretty standard practice we've seen.
Standard practice is to do a full security audit before you onboard customers.
We're fortifying the codebase every day and would expect this process to be complete in the next 2 quarters.
TIL that systemd has a credentials component: https://systemd.io/CREDENTIALS/
Thank you, 'cause I don't wanna do the wrap command thing they do. Besides that, this is a great idea.
Earlier quoted context omitted.
It is actually mentioned on the pricing page! (in one of the FAQ questions)
I wouldn’t exactly consider a mention in passing on a “What is Infisical” to be exactly headlining the fact that it’s open source.
Earlier quoted context omitted.
We provide all the main functionality completely for free under the MIT license. What this means is that all the integrations (Docker, AWS, Vercel, Kubernetes, Terraform, etc) are available completely to everyone. Next to that, all the features related to secret sharing, and security are also available under MIT. ee is only reserved for some features that are (mostly) needed by enterprises (e.g., audit logs, sso, adv…
Audit logging and SSO is pretty basic functionality that requires very little (many people would argue no ) additional effort or cost to maintain on the development side.
Re SSO: Totally get this one and I'm aware of the SSO tax — we're still figuring this one out but know currently that it's an absolute must for enterprises.
Earlier quoted context omitted.
We provide all the main functionality completely for free under the MIT license. What this means is that all the integrations (Docker, AWS, Vercel, Kubernetes, Terraform, etc) are available completely to everyone. Next to that, all the features related to secret sharing, and security are also available under MIT. ee is only reserved for some features that are (mostly) needed by enterprises (e.g., audit logs, sso, adv…
https://sso.tax/