Infisical – open-source HashiCorp Vault alternative

HashiCorp switched Vault from MPL to BSL license yesterday. The terms of how they define "competitive" products are pretty vague, which means that any commercial product that uses Vault under the hood is at risk of violating the terms of the new license. Moreover, even if it's not violating the terms of license now, it doesn't mean that HashiCorp will not change its mind in future.

Ultimately, it just means that HashiCorp is not an open source company anymore. One of the biggest benefits of open source is building on top of open source software to create even better software. HashiCorp's move makes it impossible and simply slows down innovation. In fact, in their blog post, they say that they will start referring to their previously-open-source product as "community".

Infisical is an open source alternative to HashiCorp Vault. The main difference is that it provides more tools in one platform. Some examples of these are automatic secret scanning and leak prevention, CLI for local development, integrations with services like GitHub Actions, Circle CI, etc.

The core of Infisical is available under the MIT license with only very few features being enterprise-licensed – some will say it's not ideal but at least this type of license does not impose legal risks on our users while gives us the ability to monetize the product efficiently and support the open source (MIT-based) part of the product.

Over the last year, lots of developers and companies of all sizes (from tiny startups to Fortune 10 companies) have partially or fully switched to Infisical. For them, we now process over 300 million secrets per month.

Check out our git repo here: https://github.com/Infisical/infisical

EnvKey (https://www.envkey.com/) is another OSS alternative to Vault with a bit more focus on security (disclaimer: I'm the founder).

We have a comparison with Vault here: https://www.envkey.com/compare/hashicorp-vault/

We'll probably write up a comparison with Infisical soon as well but I'd say the main thing is that our end-to-end encryption has no opt-outs (as Infisical does for many of its integrations), and we use native apps and a CLI rather than offering a web UI. End-to-end encryption in a web browser offers minimal security benefit for reasons discussed in this thread: https://news.ycombinator.com/item?id=21838795 (the discussion is from 2019 and the original NCCGroup link from 2011 is now dead, but all the same issues still apply).

Also, I'm not sure if this has been addressed yet, but it has previously been noted that Infisical was completely lacking in automated tests. EnvKey has an extensive test suite ( core tests here: https://github.com/envkey/envkey/tree/main/public/app/tests and tests for all our sdks are included in each: https://github.com/envkey/envkey/tree/main/public/sdks).

I don't know anything about this product, but just wanted to say that's a really pretty README page :D

that's a sick roadmap! keep 'em coming :)

Backed by another corporation trying to monetize it. This will go well.

  This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license.

I just sprained my eye sockets from rolling my eyes too hard.