What's New at Infisical: August Changelog

🤖 Agent Vault is in Preview: Agent Vault lets AI agents call APIs and services without ever holding the credential, so there's nothing in the agent's context for a prompt injection to exfiltrate. Scope access by HTTP method and path, add custom headers, use variables in access bundles, and review every request in session logs. Read more.

💳 Stripe API Key Rotation: We built the first ever automated Stripe API key rotation, available in no other secrets manager. Read more. 

🛡️ PAM Adds Break-Glass Access and Three New Databases: Our privileged access management solution now supports break-glass access requests for emergencies and runs health checks on account credentials. It also adds ClickHouse, Snowflake and Oracle DB accounts, with Oracle returning after the revamp. Read more.

📁 Recursive Secret Syncs: A single secret sync can now cover a folder and all of its subfolders, instead of one sync per folder. Read more.

Also Shipped

• PAM session logs now come with default masking templates. See PAM templates.
• Certificate management now includes an OCSP responder for checking certificate revocation. See how OCSP works.
• Certificate profiles and policies now support custom X.509 extensions. See certificate policies.
• Certificate syncs can now use a filter to pick which certificates to push. See certificate syncs.
• ACME DNS-01 challenges now work with PowerDNS. See the ACME CA docs.
• Secrets can now sync to Daytona. See the Daytona sync.
• Gateways now support Terraform and GCP enrollment. See Gateway Terraform.
• Secret scanning is more reliable, with findings processed in batches and an upgraded scanning engine. See secret scanning.
• Secret validation rules get an overhauled API and a new rule that keeps values unique across a project. See validation rules.
• The Infisical API is now more agent-friendly. See the API docs.
• Billing now shows a more detailed usage breakdown.
• Token auth credentials now support expiry alerts, with more than one alert per machine identity.
• External KMS now supports the AWS US ISO and ISOB regions.
• The dashboard now has a light mode with a theme toggle, plus a cmd+k command menu for getting anywhere fast.

Read the full changelog here.

Live Events

📺 Agent Vault in Action: Give Agents Access, Not Secrets

October 21, 1 PM ET, 30 minutes. Jake Hulberg, Infisical's developer relations expert, demos Agent Vault live. He’ll show how it brokers credentials so agents can reach the services they need without reading a secret, and how to connect Claude Code, Codex, or your own agent with no code changes. Save your spot >

In Case You Missed It

How Environment Variables Actually Work (and Why You Should Delete Your .env File)

Hit run and watch dotenv load a value, then click through the chain of processes that builds an app's environment. Read more.

How to solve Machine Identity Attestation in on-prem environments
How to build a chain of trust when you can’t rely on the big clouds. Read more.

Worth a Look: What We're Liking

Project HydraFusion: GitHub's new Copilot research preview combines multiple AI models as needed to handle a single coding task, instead of picking one model per prompt. Learn more.

Cursor Projects: Each Project gets its own cloud computer, a coordinator agent that plans and delegates without writing code, shared context that persists across months, and the ability to act on Slack messages, schedules, and PRs on its own. Learn more.

Amp: The Amp coding agent is now free when you bring your own compute and model subscriptions or API keys, with no Amp token fees on BYOK usage outside enterprise plans. Learn more.