LoginSign Up
← Back to all sparks
I

Infisical

INFRA · APIS
Velocity5.0

Open-source secret management platform for developers

infisical.com ↗

Infisical makes batched secret edits the default and adds bulk review for change requests.

secrets-managementapprovalspkipamagent-vault
◆Current state
Infisical ships a release almost daily across secrets, PKI, PAM and Agent Vault. The latest two make batched secret and folder changes the default in the Secrets Overview, backed by a new batch commit API, and add bulk review of secret change requests plus auto-approvals in PAM. Agent Vault now accepts member-provided credentials with personal values, and Cloudflare Workers/Pages syncs let users pick the variable type.
◆Where it's heading
Secret changes are being handled like code commits that move through approval: global approvals in v0.166.5, now batch commits and bulk review. In parallel the PKI side keeps widening (DigiCert HSM signing, Linux certificate discovery) and Agent Vault is moving from breaking changes toward per-member credentials. The frontend is also shedding its V2 component library and legacy styles.
◆Prediction
Expect approval policies to gain controls aimed at batched commits and more Agent Vault credential options over the next few releases.

◆Recent moves

  1. 2d ago

    Batched secret changes become default in Secrets Overview

    The batch-commit model from v0.167.3 becomes the default way to edit in the Secrets Overview, with the quick-add row moved to the top of the table. The rest is navigation polish: identity, user, group and role rows become real links.

    View source ↗
  2. 2d ago

    Batch secret commits, bulk change review, PAM auto-approvals

    Adds a batch commit API for secret and folder changes, bulk review of change requests and auto-approvals in PAM, extending the approval workflow that took over secret changes in v0.166.5. Agent Vault gains member-provided credential fields with personal values, and the legacy V2 UI library is removed.

    View source ↗
  3. 5d ago

    Agent Vault proxy tokens, per-signer code-signing settings

    Agent Vault proxies can now start from a proxy token and keep session logs in default storage. PKI admins can configure code signing per signer, and secret scanning gets tracking events. Most of the rest moves cert-manager and PKI screens onto the v3 UI.

    View source ↗
  4. 6d ago

    Linux server certificate discovery, RSA-OAEP for SCEP

    Linux server certificate discovery is the main addition, which extends Infisical's certificate inventory beyond its own CAs. SCEP gains RSA-OAEP key transport, and secret approvals no longer fail when SMTP does. The bulk of the diff is UI migration to Combobox and v3 tokens.

    View source ↗
  5. 7d ago

    DigiCert HSM keys for code signing; AWS/GCP trust bindings required

    Code-signing signers can now use an existing DigiCert certificate and its HSM-held key, so teams can keep their CA while using Infisical to sign. AWS and GCP machine identities now require a trust binding, a security change that existing setups may need to act on.

    View source ↗
  6. 8d ago

    PAM recordings to S3, KMS-backed CA keys, secret scanning revamp

    PAM session recordings can now live in S3-compatible storage, internal CAs can sign with AWS KMS-backed keys, and secret scanning's findings and data-source flows are rebuilt. It continues the pattern of each split-out product gaining enterprise controls, while the UI work moves to naming suggestions and a React 19 upgrade.

    View source ↗