Hacker News Reader

Comment by thamer | Hacker News Reader

I didn't see any reference to an external security audit on your website, so have you done one and if not are you planning to? All serious products in this space publish these third-party audits and sometimes certifications.

See the page for Vault: https://www.hashicorp.com/vault-compliance

Or 1Password: https://support.1password.com/security-assessments/

As the comment from jbotz mentioned, exposing secrets in environment variables seems like a major issue and it would be one of the first points covered in such an audit.

View on HN

This is actually something that we are planning to do very soon. We are currently in the public Alpha stage, but our plan is to get both a security audit and SOC 2 compliance in the coming months!

Has anyone on staff been through a soc audit? Which trust criteria will be used?

Does the app support data stores other than mongo?

Yes, we're quite familiar with SOC guidelines. We will be including all of Security, Confidentiality, Privacy, Availability, and Processing integrity categories into the SOC 2 examination. I think, given that Infisical is a secret-manager, all of these are very important!

Currently, we only support Mongo, although we received requests for some other ones. Which one are you interested in?

Almost any other standard database would be a better choice: Postgres, MySQL, even Redis.

Most companies avoid using MongoDb and lack the staff needed to administer it properly. It’s also hard to find a managed solution for Mongo in most cloud providers.

But you don’t need any cloud provider other than AWS, so why worry about that?

MongoDB provides MongoDB Atlas, our own managed service. which is supported on every cloud (AWS, Azure, GCP).

Oh, Mongo is a major turnoff. The only sensible data store to support in 2022 and beyond is Postgres, maybe SQLite IMO.

Plain-text (encrypted) files and/or sqlite would be a great complement to whatever else.

SQLite/filesystem and etcd or some kind of distributed store.

The SQLite and fs option would get you usage in Homelabs.

That's a heavy order for the SOC 2, especially if you're just starting out as a company.

Imho, it's more important that the code base is audited and the company is transparent.

Postgres!

But better yet you might want to make sure there is an abstraction layer so people can plug stuff in.

It’s a extra work but it only gets harder to do later.

Reply on news.ycombinator.com