awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into feat/point-in-time-revamp

Browse Source
This commit is contained in:
carlosmonastyrski
2025-06-05 18:31:27 -03:00
parent d5f5abef8e ce170a6a47
commit 6334ad0d07
757 changed files with 31611 additions and 4112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
docs/internals/bug-bounty.mdx
View File

@@ -1,82 +0,0 @@
---
title: "Bug bounty program"
description: " Learn about our bug bounty program and how to report vulnerabilities."
---
The Infisical Bug Bounty Program is our way of recognizing and rewarding the work of security researchers who help keep our platform secure. By reporting vulnerabilities or potential risks, you help us protect secrets, infrastructure, and the organizations who rely on us.
We value reports that help identify vulnerabilities that affect the integrity of secrets, prevent unauthorized access to environments, or expose flaws in our authentication or authorization flows.
### How to Report
- Send reports to **security@infisical.com** with clear steps to reproduce, impact, and (if possible) a proof-of-concept.
- We will acknowledge receipt within 3 business days for reports that are clearly written, technically sound, and plausibly within scope.
- We'll provide an initial assessment or next steps within 5 business days.
- **Please note**: We do not respond to spam, auto generated reports, inaccurate claims, or submissions that are clearly out of scope.
### What's in Scope?
- Vulnerabilities in our cloud-hosted platform (e.g., `app.infisical.com`, `eu.infisical.com`)
- Security issues in the open source Infisical codebase, as maintained in our official GitHub repository
- Authentication bypass, privilege escalation, or access to secrets/data without authorization
### Reward Guidelines
Bounties are based on severity, impact, and exploitability, as well as whether the report introduces a new vulnerability class or helps improve an existing fix.
| Severity | Examples | Typical Reward (USD currency) |
| --- | --- | --- |
| **Critical** | Full unauthorized access to secrets, authentication bypass, cross-tenant access, RCE, full compromise, etc | $2,000 - $5,000 |
| **High** | Privilege escalation, project-level access without authorization, persistent DoS | $750 - $2,000 |
| **Medium** | Info disclosure, scoped DoS (e.g. ReDoS with auth), or minor access control issues | $250 - $1,000 |
| **Low / Informational** | Missing headers, CSP warnings, theoretical flaws, self-hosting misconfigurations | Recognition only |
We may award lower amounts for:
- Duplicate class vulnerabilities already under review
- Patch bypasses of previously rewarded issues
- Vulnerabilities requiring unrealistic attacker conditions
All final reward amounts are determined at Infisical's discretion based on impact, report quality, and how actionable the issue is.
### Out of Scope
- Social engineering or phishing (including email hyperlink injection without code execution)
- Rate limiting issues on non-sensitive endpoints
- Denial-of-service attacks that require authentication and don't impact core service availability
- Findings based on outdated or forked code not maintained by the Infisical team
- Vulnerabilities in third-party dependencies unless they result in a direct risk to Infisical users
### Responsible Disclosure
We ask that researchers:
- Avoid accessing data that isn't yours
- Do not publicly disclose without coordination
- Use testing accounts where possible
- Give us a reasonable window to investigate and patch before going public
Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally.
### Program Conduct and Enforcement
We value professional and collaborative interaction with security researchers. To maintain the integrity of our bug bounty program, we expect all participants to adhere to the following guidelines:
- Maintain professional communication in all interactions
- Do not threaten public disclosure of vulnerabilities before we've had reasonable time to investigate and address the issue
- Do not attempt to extort or coerce compensation through threats
- Follow the responsible disclosure process outlined in this document
- Do not use automated scanning tools without prior permission
Violations of these guidelines may result in:
1. **Warning**: For minor violations, we may issue a warning explaining the violation and requesting compliance with program guidelines.
2. **Temporary Ban**: Repeated minor violations or more serious violations may result in a temporary suspension from the program.
3. **Permanent Ban**: Severe violations such as threats, extortion attempts, or unauthorized public disclosure will result in permanent removal from the Infisical Bug Bounty Program.
We reserve the right to reject reports, withhold bounties, and remove participants from the program at our discretion for conduct that undermines the collaborative spirit of security research.
Infisical is committed to working respectfully with security researchers who follow these guidelines, and we strive to recognize and reward valuable contributions that help protect our platform and users.

10
docs/internals/permissions/organization-permissions.mdx
View File

@@ -142,12 +142,10 @@ Below is a comprehensive list of all available organization-level subjects and t
#### Subject: `billing`
| Action | Description |
| -------- | ------------------------------------------------ |
| `read` | View billing information and subscription status |
| `create` | Set up new payment methods or subscriptions |
| `edit` | Modify billing details or subscription plans |
| `delete` | Remove payment methods or cancel subscriptions |
| Action | Description |
| ---------------- | ------------------------------------------------ |
| `read` | View billing information and subscription status |
| `manage-billing` | Manage billing details and subscription plans |
### Templates & Automation

29
docs/internals/permissions/project-permissions.mdx
View File

@@ -323,3 +323,32 @@ Supports conditions and permission inversion
| `create` | Create new SSH certificate templates |
| `edit` | Modify SSH template configurations |
| `delete` | Remove SSH certificate templates |
### Secret Scanning
#### Subject: `secret-scanning-data-sources`
| Action | Description |
| -------- | ---------------------------------------------------- |
| `read-data-sources` | View Data Sources |
| `create-data-sources` | Create new Data Sources |
| `edit-data-sources` | Modify Data Sources |
| `delete-data-sources` | Remove Data Sources |
| `read-data-source-resources` | View Data Source Resources |
| `read-data-source-scans` | View Data Source Scans |
| `trigger-data-source-scans` | Trigger Data Source Secret Scans |
#### Subject: `secret-scanning-findings`
| Action | Description |
| -------- | --------------------------------- |
| `read-findings` | View Secret Scanning Findings |
| `update-findings` | Update Secret Scanning Findings |
#### Subject: `secret-scanning-configs`
| Action | Description |
| ---------------- | ------------------------------------------------ |
| `read-configs` | View Secret Scanning Project Configuration |
| `update-configs` | Update Secret Scanning Project Configuration |

4
docs/internals/security.mdx
View File

@@ -117,7 +117,3 @@ Whether or not Infisical or your employees can access data in the Infisical inst
It should be noted that, even on Infisical Cloud, it is physically impossible for employees of Infisical to view the values of secrets if users have not explicitly granted Infisical access to their project (i.e. opted out of zero-knowledge).
Please email security@infisical.com if you have any specific inquiries about employee data and security policies.
## Bug Bounty Program
We run a [Bug Bounty Program](/internals/bug-bounty) to recognize and reward security researchers who help make Infisical more secure.
If you've found a vulnerability, please review the program details for scope, disclosure guidelines, and reward tiers.