You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/documentation/platform/secret-scanning.mdx
+107
Original file line number
Diff line number
Diff line change
@@ -7,6 +7,113 @@ The Infisical Secret Scanner allows you to keep an overview and stay alert of ex
7
7
8
8
To further enhance security, we recommend you also use our [CLI Secret Scanner](/cli/scanning-overview#automatically-scan-changes-before-you-commit) to scan for exposed secrets prior to pushing your changes.
9
9
10
+
11
+
<Accordiontitle="Self-hosting">
12
+
13
+
To setup secret scanning on your own instance of Infisical, you can follow the steps below.
14
+
15
+
<Steps>
16
+
<Steptitle="Create a GitHub App">
17
+
Create a new GitHub app in your GitHub organization or personal [Developer Settings](https://github.com/settings/apps).
To configure the GitHub app to work with Infisical, you'll need to modify the following settings:
23
+
- **Homepage URL**: Required to be set. Set it to the URL of your Infisical instance. (e.g. `https://app.infisical.com`)
24
+
- **Setup URL**: Set this to `https://<your-infisical-instance.com>/organization/secret-scanning`
25
+
- **Webhook URL**: Set this to `https://<your-infisical-instance.com>/api/v1/secret-scanning/webhook`
26
+
- **Webhook Secret**: Set this to a random string. This is used to verify the webhook request from Infisical. Use `openssl rand -base64 32` in your terminal to generate a random secret.
27
+
28
+
<Note>
29
+
Remember to save the webhook secret as you will need it in the next step.
Now you can create the GitHub app by clicking on the "Create GitHub App" button.
56
+
57
+
<Note>
58
+
If you want other Github users to be able to install the app, you need to tick the "Any account" option under "Where can this GitHub App be installed?"
After clicking the "Create GitHub App" button, you will be redirected to the GitHub settings page. Here you can copy the "App ID" and save it for later when you need to configure your environment variables for your Infisical instance.
Create a new app private key by clicking on the "Generate a private key" button under the "Private keys" section.
78
+
79
+
Once you click the "Generate a private key" button, the private key will be downloaded to your computer. Save this file for later as you will need the private key when configuring Infisical.
Remember to save the private key as you will need it in the next step.
85
+
</Note>
86
+
87
+
</Step>
88
+
89
+
90
+
<Steptitle="Configure your Infisical instance">
91
+
Now you can configure your Infisical instance by setting the following environment variables:
92
+
93
+
- `SECRET_SCANNING_GIT_APP_ID`: The App ID of your GitHub App.
94
+
- `SECRET_SCANNING_GIT_APP_SLUG`: The slug of your GitHub App.
95
+
- `SECRET_SCANNING_PRIVATE_KEY`: The private key of your GitHub App that you created in a previous step.
96
+
- `SECRET_SCANNING_WEBHOOK_SECRET`: The webhook secret of your GitHub App that you created in a previous step.
97
+
</Step>
98
+
</Steps>
99
+
100
+
After restarting your Infisical instance, you should be able to use the secret scanning feature within your organization. Follow the steps below to add the GitHub App to your Infisical organization.
101
+
</Accordion>
102
+
103
+
## Install the Infisical Radar GitHub App
104
+
105
+
To install the GitHub App, press the "Integrate With GitHub" button in the top right corner of your Infisical Secret Scanning dashboard.
106
+
107
+
108
+
109
+
Next, you'll be prompted to select which organization you'd like to install the app into. Select the organization you'd like to install the app into by clicking the organization in the menu.
Copy file name to clipboardExpand all lines: docs/internals/bug-bounty.mdx
+22-2
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ All final reward amounts are determined at Infisical's discretion based on impac
41
41
42
42
### Out of Scope
43
43
44
-
- Social engineering or phishing
44
+
- Social engineering or phishing (including email hyperlink injection without code execution)
45
45
- Rate limiting issues on non-sensitive endpoints
46
46
- Denial-of-service attacks that require authentication and don't impact core service availability
47
47
- Findings based on outdated or forked code not maintained by the Infisical team
@@ -57,4 +57,24 @@ We ask that researchers:
57
57
- Use testing accounts where possible
58
58
- Give us a reasonable window to investigate and patch before going public
59
59
60
-
Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally.
60
+
Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally.
61
+
62
+
### Program Conduct and Enforcement
63
+
64
+
We value professional and collaborative interaction with security researchers. To maintain the integrity of our bug bounty program, we expect all participants to adhere to the following guidelines:
65
+
66
+
- Maintain professional communication in all interactions
67
+
- Do not threaten public disclosure of vulnerabilities before we've had reasonable time to investigate and address the issue
68
+
- Do not attempt to extort or coerce compensation through threats
69
+
- Follow the responsible disclosure process outlined in this document
70
+
- Do not use automated scanning tools without prior permission
71
+
72
+
Violations of these guidelines may result in:
73
+
74
+
1.**Warning**: For minor violations, we may issue a warning explaining the violation and requesting compliance with program guidelines.
75
+
2.**Temporary Ban**: Repeated minor violations or more serious violations may result in a temporary suspension from the program.
76
+
3.**Permanent Ban**: Severe violations such as threats, extortion attempts, or unauthorized public disclosure will result in permanent removal from the Infisical Bug Bounty Program.
77
+
78
+
We reserve the right to reject reports, withhold bounties, and remove participants from the program at our discretion for conduct that undermines the collaborative spirit of security research.
79
+
80
+
Infisical is committed to working respectfully with security researchers who follow these guidelines, and we strive to recognize and reward valuable contributions that help protect our platform and users.
Specifies the network interface Infisical will bind to when accepting incoming connections.
34
+
35
+
By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
36
+
37
+
To make the application accessible externally (e.g., for self-hosted deployments), set this to `0.0.0.0`, which tells the server to listen on all network interfaces.
0 commit comments