Infisical

Somewhere right now, a developer is about to paste a database password into a Slack message. They know they shouldn't. They'll do it anyway, because the alternative has always been worse. Infisical exists to make sure that the alternative is no longer worse.

The company sits in San Francisco, but its real address is a GitHub repository with more than 27,000 stars and 40 million downloads. Infisical builds the unglamorous plumbing that keeps software secrets - API keys, certificates, database credentials, SSH access - out of the places they should never be: plaintext files, chat logs, and the public internet. It is the kind of problem nobody puts on a poster, and exactly the kind of problem that takes down companies when it goes wrong.

Secret sprawl is a quiet disaster

Every application needs secrets to function. A web app needs the key to its database. A CI pipeline needs a token to deploy. An AI agent needs credentials to call an API. For years, the default way to manage these was the .env file - a humble text document of passwords, copied between laptops, emailed around, occasionally committed to git by accident. The polite industry term is "secret sprawl." The honest term is a mess.

The enterprise answer was HashiCorp Vault: powerful, comprehensive, and famously difficult to operate. It solved the problem for teams who could afford a dedicated platform engineer to babysit it. Everyone else kept pasting passwords into Slack. There was a gap in the middle - between a sticky note and a fortress - and that gap was where most of the world's software actually lived.

In 2024, HashiCorp moved Vault to a more restrictive BSL license, then was acquired by IBM. The open-source middle got even emptier. That vacuum is the tension Infisical was built around, and it has not let go of it since.

Bet on developers, and keep it open

Infisical was founded in 2022 and went through Y Combinator's Winter 2023 batch. The wager was specific: build secrets management that a developer could adopt in an afternoon, keep the core MIT-licensed so anyone could self-host it, and refuse to make security a luxury good. Where Vault drifted toward restriction, Infisical leaned the other way.

The bet attracted believers quickly. Elad Gil showed up as a seed angel in 2023, alongside Google's Gradient Ventures and Y Combinator. Two years later, the same Elad Gil came back to lead the Series A. Investors who write a second, much larger check tend to have seen something work.

One stack, not one feature

Infisical started as secrets management and kept building outward. Today it is a full security stack - the parts of infrastructure security that used to require four different vendors, glued together with hope.

One detail amuses the engineers who notice it: a security-infrastructure company wrote roughly 97% of its codebase in TypeScript. Security purists expect Rust or Go and a great deal of solemnity. Infisical chose the language of the web developers it wants to serve. The medium is part of the message.

Numbers, customers, and a second check

The skeptic's question is fair: does anyone actually run this in production? The customer list answers it - Hugging Face, LG, Lucid Software, Writer, OpenRouter, and Excalidraw among them. These are teams with real consequences for getting secrets wrong, and they chose the open-source option.

In the year before the Series A, Infisical reported around 20x revenue growth and reached cash-flow positive - rare enough in developer infrastructure to be worth saying twice. The platform claims 99.99% availability and secures secrets at a scale measured in billions per month. The repository, meanwhile, keeps doing the quiet work of recruiting: every star is a developer who tried it and stayed.

Make security enjoyable, of all things

Infisical's stated mission is to make security "more accessible and enjoyable for every developer." Enjoyable is a strange word for a field that usually trades in fear, audits, and the cold sweat of a 3 a.m. incident. That word choice is the whole point. Security that developers dread is security that developers route around, and routed-around security is how secrets end up in Slack in the first place.

The company's wager is that the best way to make systems secure is to make the secure path the easy path. Open source keeps it honest - if the tool were bad, 100,000 developers would simply leave. They haven't.

The machines need secrets too

Here is the part that changes the stakes. Software used to be written by people and run by people. Increasingly it is run by AI agents - autonomous programs that call APIs, query databases, and act on their own. Every one of those actions needs a credential, and an agent that holds a credential is an agent that can leak one.

Infisical's 2026 launch of Agent Vault aims directly at this: a proxy that lets an agent make authenticated requests without ever seeing the secret behind them. The machine acts; the key stays hidden. If the last decade was about giving humans a safe place to keep secrets, the next is about doing the same for the software that increasingly outnumbers them.

Which brings us back to that developer, the one about to paste a password into Slack. The difference now is that the easy thing and the safe thing have finally become the same thing. A single command pulls the secret in at runtime. Nothing gets copied. Nothing gets pasted. The chat stays boring, which is the highest compliment you can pay a security tool. Infisical did not make secrets disappear. It made them stop showing up where they were never supposed to be.