Repository: Infisical/infisical

Stars: 25924

CLAUDE.md Copy Chapter

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Essential Commands Copy Chapter

- make reviewable-api / make reviewable-ui — lint:fix + type:check (run before PRs)
- cd backend && npm run migration:new — create new DB migration
- cd backend && npm run generate:schema — regenerate Zod types from DB after migration changes

Both backend and frontend use @app/ as path alias to ./src/.

Repository Structure Copy Chapter

Infisical is an open-source secret management platform. Monorepo layout:

infisical/
├── backend/               # Fastify 4 API server (see backend/CLAUDE.md)
├── frontend/              # React 18 SPA (see frontend/CLAUDE.md)
├── docs/                  # Documentation site (Mintlify-based)
├── docker-compose.dev.yml        # Local dev (PostgreSQL, Redis, backend, frontend, Nginx)
├── docker-compose.prod.yml       # Production deployment stack
├── docker-compose.bdd.yml        # BDD testing environment
├── docker-compose.e2e-dbs.yml    # E2E test databases (Oracle, SAP, Snowflake, etc.)
├── Dockerfile.standalone-infisical       # Standalone image (frontend + backend)
├── Dockerfile.fips.standalone-infisical  # FIPS-compliant standalone image
├── .github/               # CI workflows, PR template
└── CLAUDE.md               # This file

- backend/ — Fastify 4 API server, TypeScript, PostgreSQL via Knex, BullMQ queues. See backend/CLAUDE.md for architecture, patterns, and commands.
- frontend/ — React 18 SPA, Vite 6, TanStack Router + React Query, Tailwind CSS v4. See frontend/CLAUDE.md for architecture, patterns, and commands.
- docs/ — Product documentation site. Has its own Dockerfile for building. Reference docs for up-to-date feature descriptions and API usage.

Enterprise features live in backend/src/ee/ (services and routes), registered before community routes so they can override/extend them.

Self-Hosted Deployment Copy Section

Infisical supports self-hosted deployment via Docker. Key considerations:
- Dockerfile.standalone-infisical — single-container image with both frontend and backend; used for simple deployments.
- Dockerfile.fips.standalone-infisical — FIPS 140-2 compliant variant for regulated environments. Be strict about not introducing dependencies that break FIPS compliance.
- docker-compose.prod.yml — production compose with backend, PostgreSQL, and Redis.
- New backend dependencies should be evaluated carefully — they affect container size, FIPS compliance, and the encryption boundary. Check docs/ for self-hosted deployment documentation when in doubt.

Dependency Policy Copy Section

Both backend/ and frontend/ enforce a minimum release age of 7 days for npm packages (configured via .npmrc in each directory). This means npm install will only resolve package versions published at least 7 days ago, as a supply-chain security measure.

Cross-Cutting Patterns Copy Chapter

Auth & Permissions Copy Section

Auth modes (JWT, IDENTITY_ACCESS_TOKEN, SCIM_TOKEN, MCP_JWT) are extracted in backend/src/server/plugins/auth/. Authorization uses CASL (@casl/ability) with project-level and org-level permission checks — see backend/CLAUDE.md for backend details and frontend/CLAUDE.md for frontend permission hooks/HOCs. Note: API_KEY and SERVICE_TOKEN auth modes are deprecated — do not use them in new code.

Service Factory + Manual DI (Backend) Copy Section

No IoC container. Every service is a factory function with explicit dependencies. The entire dependency graph is wired in backend/src/server/routes/index.ts — see backend/CLAUDE.md for the full wiring map and patterns.

API Layer (Frontend) Copy Section

React Query + Axios with query key factories per domain. Each API domain in frontend/src/hooks/api/ has queries.tsx, mutations.tsx, and types.tsx — see frontend/CLAUDE.md for conventions.

Keeping CLAUDE.md Up to Date Copy Chapter

When making significant changes to the codebase (new services, architectural shifts, new patterns, major refactors), update the relevant CLAUDE.md file(s) with high-level findings. This includes this root file for cross-cutting concerns, backend/CLAUDE.md for backend changes, and frontend/CLAUDE.md for frontend changes. The goal is to keep these files accurate as living documentation so future sessions start with correct context.

Wiring a New Full-Stack Feature Copy Chapter

1. Backend: Create service module, migration, wire DI, add routes — see checklist in backend/CLAUDE.md
2. Frontend: Add API hooks in src/hooks/api/<domain>/, create page/view, wire route — see frontend/CLAUDE.md for routing and component patterns
3. Run make reviewable-api and make reviewable-ui before submitting

README.md Copy Chapter

<h1 align="center">
<img width="300" src="/img/logoname-white.svg#gh-dark-mode-only" alt="infisical">
</h1>
<p align="center">
<p align="center"><b>The open-source secret management platform</b>: Sync secrets/configs across your team/infrastructure and prevent secret leaks.</p>
</p>

<h4 align="center">
<a href="https://infisical.com/slack">Slack</a> |
<a href="https://infisical.com/">Infisical Cloud</a> |
<a href="https://infisical.com/docs/self-hosting/overview">Self-Hosting</a> |
<a href="https://infisical.com/docs/documentation/getting-started/introduction">Docs</a> |
<a href="https://www.infisical.com">Website</a> |
<a href="https://infisical.com/careers">Hiring (Remote/SF)</a>
</h4>

<h4 align="center">
<a href="https://github.com/Infisical/infisical/blob/main/LICENSE">
<img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="Infisical is released under the MIT license." />
</a>
<a href="https://github.com/infisical/infisical/blob/main/CONTRIBUTING.md">
<img src="https://img.shields.io/badge/PRs-Welcome-brightgreen" alt="PRs welcome!" />
</a>
<a href="https://github.com/Infisical/infisical/issues">
<img src="https://img.shields.io/github/commit-activity/m/infisical/infisical" alt="git commit activity" />
</a>
<a href="https://cloudsmith.io/~infisical/repos/">
<img src="https://img.shields.io/badge/Downloads-6.95M-orange" alt="Cloudsmith downloads" />
</a>
<a href="https://infisical.com/slack">
<img src="https://img.shields.io/badge/chat-on%20Slack-blueviolet" alt="Slack community channel" />
</a>
<a href="https://twitter.com/infisical">
<img src="https://img.shields.io/twitter/follow/infisical?label=Follow" alt="Infisical Twitter" />
</a>
</h4>

<img src="/img/infisical_github_repo2.png" width="100%" alt="Dashboard" />

Introduction Copy Chapter

Infisical is the open source secret management platform that teams use to centralize their application configuration and secrets like API keys and database credentials as well as manage their internal PKI.

We're on a mission to make security tooling more accessible to everyone, not just security teams, and that means redesigning the entire developer experience from ground up.

Features Copy Chapter

Secrets Management: Copy Section

- Dashboard: Manage secrets across projects and environments (e.g. development, production, etc.) through a user-friendly interface.
- Secret Syncs: Sync secrets to platforms like GitHub, Vercel, AWS, and use tools like Terraform, Ansible, and more.
- Secret versioning and Point-in-Time Recovery: Keep track of every secret and project state; roll back when needed.
- Secret Rotation: Rotate secrets at regular intervals for services like PostgreSQL, MySQL, AWS IAM, and more.
- Dynamic Secrets: Generate ephemeral secrets on-demand for services like PostgreSQL, MySQL, RabbitMQ, and more.
- Secret Scanning and Leak Prevention: Prevent secrets from leaking to git.
- Infisical Kubernetes Operator: Deliver secrets to your Kubernetes workloads and automatically reload deployments.
- Infisical Agent: Inject secrets into applications without modifying any code logic.

Certificate Management Copy Section

- Internal CA: Create and manage a private
CA hierarchy directly within Infisical.
- External CA: Integrate with third-party certificate authorities such as Let’s Encrypt, DigiCert, Microsoft AD CS, and more to leverage existing PKI infrastructure
or issue publicly trusted certificates.
- Certificate Lifecycle Management: Create certificate profiles and policies to control how certificates are issued, including enrollment methods such as API, ACME, or EST. Manage the full lifecycle from issuance to renewal and revocation with CRL and inventory tracking.
- Certificate Syncs: Sync certificates to external platforms like AWS Certificate Manager and Azure Key Vault.
- Alerting: Configure alerting for expiring CA and end-entity certificates.

Infisical Key Management System (KMS): Copy Section

- Cryptographic Keys: Centrally manage keys across projects through a user-friendly interface or via the API.
- Encrypt and Decrypt Data: Use symmetric keys to encrypt and decrypt data.

Infisical SSH Copy Section

- Signed SSH Certificates: Issue ephemeral SSH credentials for secure, short-lived, and centralized access to infrastructure.

General Platform: Copy Section

- Authentication Methods: Authenticate machine identities with Infisical using a cloud-native or platform agnostic authentication method (Kubernetes Auth, GCP Auth, Azure Auth, AWS Auth, OIDC Auth, Universal Auth).
- Access Controls: Define advanced authorization controls for users and machine identities with RBAC, additional privileges, temporary access, access requests, approval workflows, and more.
- Audit logs: Track every action taken on the platform.
- Self-hosting: Deploy Infisical on-prem or cloud with ease; keep data on your own infrastructure.
- Infisical SDK: Interact with Infisical via client SDKs (Node, Python, Go, Ruby, Java, .NET)
- Infisical CLI: Interact with Infisical via CLI; useful for injecting secrets into local development and CI/CD pipelines.
- Infisical API: Interact with Infisical via API.

Getting started Copy Chapter

Check out the Quickstart Guides

| Use Infisical Cloud | Deploy Infisical on premise |
| ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| The fastest and most reliable way to <br> get started with Infisical is signing up <br> for free to Infisical Cloud. | <br> View all deployment options |

Run Infisical locally Copy Section

To set up and run Infisical locally, make sure you have Git and Docker installed on your system.

Linux/macOS:

git clone https://github.com/Infisical/infisical && cd "$(basename $_ .git)" && cp .env.example .env && docker compose -f docker-compose.prod.yml up

Windows (Command Prompt):

git clone https://github.com/Infisical/infisical && cd infisical && copy .env.example .env && docker compose -f docker-compose.prod.yml up

Once running, create an account at http://localhost:80.

Contributing? Check out our guide to see how to get started.

Scan and prevent secret leaks Copy Section

On top managing secrets with Infisical, you can also [scan for over 140+ secret types]() in your files, directories and git repositories.

To scan your full git history, run:

infisical scan --verbose

Install pre commit hook to scan each commit before you push to your repository

infisical scan install --pre-commit-hook

Learn about Infisical's code scanning feature here

Open-source vs. paid Copy Chapter

This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license.

If you are interested in managed Infisical Cloud of self-hosted Enterprise Offering, take a look at our website or book a meeting with us.

Security Copy Chapter

Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!

Infisical takes security issues very seriously. If you have any concerns about Infisical or believe you have uncovered a vulnerability, please get in touch via the e-mail address [email protected]. In the message, try to provide a description of the issue and ideally a way of reproducing it. The security team will get back to you as soon as possible.

Note that this security address should be used only for undisclosed vulnerabilities. Please report any security problems to us before disclosing it publicly.

Contributing Copy Chapter

Whether it's big or small, we love contributions. Check out our guide to see how to get started.

Not sure where to get started? You can:

- Join our <a href="https://infisical.com/slack">Slack</a>, and ask us any questions there.

We are hiring! Copy Chapter

If you're reading this, there is a strong chance you like the products we created.

You might also make a great addition to our team. We're growing fast and would love for you to join us.