Hi All, I'm evaluating Infisical as an alternative to a selfhosted VaultWarden we have for an Open Source project (5 maintainers) with over 30 repositories Scenario 1: We aim to use short lived tokens and OIDC where possible, but some services require an account set up and minting tokens from that account, so we try to limit these to 90 days - which means every 90 days someone has to log in and rotate the token. the worst case is where these services don't support an Org setup, so we have a shared account (with username/password + MFA) in the Vault (MFA seed -> TOTP displayed). Can we use Infisical for this (I haven't found the option to create a secret card that allows recording username / password or an MFA seed to display TOTP EDIT: found dynamic secret but it's enterprise only Scenario 2: A large part of the secrets we have to maintain is to publish libraries of the open source project across npmjs, pypi, nuget, maven, ... this is done via GH Actions > Repo secrets > Workflows We currently take those tokens (90 day validity) and put them sops-encrypted (AWS KMS) into an IaC repo (Terraform provider GitHub), we have a gh workflow using an IAM role (OIDC) to KMS decrypt the tokens and put them in place across 30+ GH Repositories (these are all auto built and publish on a schedule). I tried setting up a Connection > GitHub via GH App (org access for all the 30+ repos) my goal is to set up auto sync from Infisical to all 30+ repos, but repos get added dynamically - currently Terraform creates the repo, sets up branch protection and all the secrets.. the problem with that approach is that the tokens live in TF State (AWS S3). We are adopting OIDC publishers and trust relationships where possible, but a lot of the first time publishing requires a token .. Can Infisical help us with both scenarios? Is it possible and what is the plan requirements? I could imagine that with the infisical TF provider we could set up the gh repo dynamically and create an integration.. but over 30 integrations would probably not fit on the free plan? project: https://cdktn.io GH Org:

cdktn-io

-> where all the pre-built providers are maintained

Hey @Vincent De Smet, your plan to to setup syncs per repo via terraform should work; if they share secrets you can actually use one sync to sync to one or more repos in the org; otherwise you'd need to create a sync per repo. I'm a little hazy on what you're trying to accomplish in scenario one but if dynamic secrets solves your problem then yes it would require an enterprise license

thanks, seems VaultWarden with TOTP is better for us then we won't be needing infisical gh repo sync as it seems it can't manage the amount of repos we need to sync to thanks.. it was promising but attention to detail in the responses here is lacking

Hi. I am not an expert but I am happy to know that you care about security on your OS project. It is very important given the supply chain attacks happening recently.

thanks @Hassaan Zaidi - Infisical was promising aside from the limitations mentioned above, never hearing back and receiving support from another solution https://cdktn.io/#supporters