What Infisical/infisical shipped

This week: v4 gets login, MFA, SSO and first-run setup behind the v4-app flag. Secret search terms move out of URLs, CRLs now verify against externally signed intermediates, and Agent Vault members can sign in to MCP OAuth services themselves.

This week in Infisical: the v4 auth and onboarding flow is complete behind the v4-app flag, covering login, organization selection, signup, MFA, SSO entry, invites, account recovery, password setup and first-run organization and instance screens. Security fixes include sending secret search terms in the request body so pasted values no longer reach logs, signing CRLs with the CA certificate subject so externally signed intermediates verify, and capping Data Explorer results at 16 MB for Postgres, MySQL and Snowflake. Agent Vault now lets each member sign in to MCP OAuth services, and deleting a project returns you to that product's project list.

This week: soft-delete for certificates, Imperva Cloud WAF certificate sync, Azure Key Vault managed identity, GitHub PR secret scanning, TLS certificate-bound tokens, and Agent Vault skills.

This week in Infisical: - Deleting a certificate now soft-deletes it, keeping the record as Deleted and restorable. - Imperva Cloud WAF joins as a certificate sync destination. - Azure Key Vault connections gain a Managed Identity method. - Databricks connections accept optional OAuth scopes for least privilege. - Secret scanning adds GitHub PR scan workflows. - TLS Certificate Auth can bind access tokens to the client certificate. - Agent Vault adds skills in access bundles and sessions on behalf of users. - HSM-backed internal CAs support ML-DSA keys. These changes give teams more control over certificates, credentials, and agent sessions.

This week: bulk review for change requests, Reveal All in one request, variable types for Cloudflare syncs, member-provided credentials and token-started proxies in Agent Vault, and a private batch commit route for secrets and folders.

This week in Infisical: change requests can now be reviewed in bulk from the Open tab, and Reveal All fetches a page of secret values in one request instead of one per row. Cloudflare Workers and Pages syncs let you pick the variable type. Agent Vault services can use member-provided credential fields, and proxies start from a token so many machines or containers share one. A private v2 batch commit route for secrets and folders was added, PKI admins can narrow signer alerts, and the Manage Permissions sheet was rebuilt so access is granted from the row.

This week: AWS KMS-backed signing keys for internal CAs, Agent Vault variables shared across bundles, LiteLLM proxy master key validation fixed, backend filtering on findings, and Insights previews for plans without it.

This week's changes: internal CAs can keep signing keys in AWS KMS with all signing done there, Agent Vault variables now belong to the vault instead of a single access bundle, LiteLLM connections using the proxy master key now validate, identity token uses-remaining counters expire with their tokens, the findings page filters on the backend, and Insights shows a blurred preview when it is not on the plan. A round of interface work also landed: redesigned Secret Scanning data source flow, secret name cell fixes, and easier-to-find Manage Access on the secrets overview.

This week: Keeper and Cloudflare Secrets Store syncs, GCP service account key rotation, reminders over alert channels, UltraDNS and Google Cloud DNS for ACME certs, and fixes for secret references with spaces and DNS rebinding in integrations.

New this week in Infisical: Keeper Password Manager sync and Cloudflare Secrets Store sync, GCP Service Account Key rotation that creates and rotates keys on a schedule, and secret reminders delivered through email, Slack, webhook or PagerDuty instead of email only. Certificate issuance now supports UltraDNS and Google Cloud DNS as ACME DNS-01 providers. We also fixed secret references to names with spaces, blocked DNS rebinding across many integrations, recorded the watched resource name in alert audit events, and fixed concurrent secret creation in root folders that could hang and return 500 errors.

Machine identities now link root groups to sub-orgs. Agent Vault adds session logs and bundle variables. Alerts moved to shared alerting. Secrets table columns resize. Sub-org tokens enforce membership.

This week's updates focus on enterprise infrastructure and security. Machine identities can link root groups to sub-organizations via Terraform. Agent Vault adds session logging to S3 and bundle variables for shared token management. Application alerts now use the shared alerting module for email, Slack, webhook and PagerDuty delivery. Sub-org token enforcement prevents deprovisioned users from maintaining API access. Secrets table columns are resizable. Projects list gains a leave action.

This week: Terraform gateway support, redesigned move picker, multi-alert machine identities, upgraded scanning with fewer false positives, external CA certificates store real attributes, Digital Ocean and Azure syncs are safer and more correct.

Infisical shipped major improvements this week: Terraform can now manage gateways with DELETE and rename support. The move destination picker was redesigned for better UX. Machine identity alerts now support multiple event types. The secret scanning engine upgraded to reduce false positives from 364 to 221. External CA certificates now store real subject data. Digital Ocean and Azure Key Vault syncs are safer with better hyphen handling and conflict detection. CLI login for signups completes properly. SPIFFE bundles use native format. Seven documentation updates keep guides current.

V0.165.13 ships light mode, event-triggered alerts, recursive secret syncs, and filter-based certificate picks. PowerDNS support and better billing insights round out the week.

This week Infisical v0.165.13 brings light mode support so users can choose their preferred interface theme. Event-triggered alerts now fire immediately instead of waiting for daily scans. Recursive secret syncs push secrets from entire folder hierarchies, and certificate syncs pick certificates by filter to automatically handle new issues. PowerDNS joins as a DNS-01 provider, and billing V2 now shows usage broken down by organization and project.