awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

merge main

Browse Source
This commit is contained in:
Scott Wilson
2025-06-02 16:24:55 -07:00
parent d924580599 739ef8e05a
commit 8730d14104
722 changed files with 30947 additions and 13097 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/internals/bug-bounty.mdx
View File

@@ -10,8 +10,8 @@ We value reports that help identify vulnerabilities that affect the integrity of
### How to Report
- Send reports to **security@infisical.com** with clear steps to reproduce, impact, and (if possible) a proof-of-concept.
- We will acknowledge receipt within 3 business days.
- We'll provide an initial assessment or next steps within 5 business days.
- You will receive follow ups from our team if we deam your report to be a legitimate vulnerability or need further clarification. We do not respond to spam, auto generated reports, inaccurate claims, or submissions that are clearly out of scope.
### What's in Scope?
@@ -27,7 +27,7 @@ Bounties are based on severity, impact, and exploitability, as well as whether t
| --- | --- | --- |
| **Critical** | Full unauthorized access to secrets, authentication bypass, cross-tenant access, RCE, full compromise, etc | $2,000 - $5,000 |
| **High** | Privilege escalation, project-level access without authorization, persistent DoS | $750 - $2,000 |
| **Medium** | Info disclosure, scoped DoS (e.g. ReDoS with auth), or minor access control issues | $250 - $1,000 |
| **Medium** | Info disclosure, scoped DoS (e.g. ReDoS with auth), or minor access control issues | $100 - $1,000 |
| **Low / Informational** | Missing headers, CSP warnings, theoretical flaws, self-hosting misconfigurations | Recognition only |

10
docs/internals/permissions/organization-permissions.mdx
View File

@@ -142,12 +142,10 @@ Below is a comprehensive list of all available organization-level subjects and t
#### Subject: `billing`
| Action | Description |
| -------- | ------------------------------------------------ |
| `read` | View billing information and subscription status |
| `create` | Set up new payment methods or subscriptions |
| `edit` | Modify billing details or subscription plans |
| `delete` | Remove payment methods or cancel subscriptions |
| Action | Description |
| ---------------- | ------------------------------------------------ |
| `read` | View billing information and subscription status |
| `manage-billing` | Manage billing details and subscription plans |
### Templates & Automation

14
docs/internals/permissions/project-permissions.mdx
View File

@@ -178,12 +178,14 @@ Supports conditions and permission inversion
#### Subject: `secret-approval`
| Action | Description |
| -------- | ----------------------------------- |
| `read` | View approval policies and requests |
| `create` | Create new approval policies |
| `edit` | Modify approval policies |
| `delete` | Remove approval policies |
| Action | Description |
| --------------------- | ----------------------------------------------------------------------------------- |
| `read` | View approval policies and requests |
| `create` | Create new approval policies |
| `edit` | Modify approval policies |
| `delete` | Remove approval policies |
| `allow-change-bypass` | Allow request creators to merge changes without approval in break-glass situations |
| `allow-access-bypass` | Allow request creators to access secrets without approval in break-glass situations |
#### Subject: `secret-rotation`