env-master and Infisical
Infisical is the closest reference point: same class of problem, machine identities, a similar model of projects and environments. Here is where we differ — without pretending the competitor is worse than it is.
Access to the code
The advantage here is theirs, and pretending otherwise would be silly: Infisical has an open core you can read and run yourself. env-master is a closed managed service — there is nothing to read. In exchange we describe the threat model down to a level you can check by behaviour: which key encrypts what, what the running process sees, what lands in the log.
What we say about encryption
Infisical dropped end-to-end encryption by default in 2023 because the dashboard and integrations needed plaintext. We never walked that path, because we never promised otherwise: our machine path is client-side, revealing a value to a person decrypts on the server, and the security page says so in plain words.
What they do not have
- a mobile client with the audit feed and approvals;
- identities scoped to a key set rather than only to an environment;
- restricted visibility: the value is never shown to a person at all — only a service fetches it, under its own identity.
When to pick Infisical
If you need to read the source and run the store inside your own perimeter, we do not offer that at all. If you need a broad catalogue of ready cloud-provider integrations, theirs is further along. We fit where an audit trail of every read and a narrow access scope matter more than catalogue breadth.