4 ms·
I didn't see any reference to an external security audit on your website, so have you done one and if not are you planning to? All serious products in this spac
by thamer 4y ago
I didn't see any reference to an external security audit on your website, so have you done one and if not are you planning to? All serious products in this space publish these third-party audits and sometimes certifications.
See the page for Vault: https://www.hashicorp.com/vault-compliance https://www.hashicorp.com/vault-compliance
Or 1Password: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/
As the comment from jbotz mentioned, exposing secrets in environment variables seems like a major issue and it would be one of the first points covered in such an audit.
- vmatsiiako 4y agoThis is actually something that we are planning to do very soon. We are currently in the public Alpha stage, but our plan is to get both a security audit and SOC 2 compliance in the coming months!
- bearzdev 4y agoHas anyone on staff been through a soc audit? Which trust criteria will be used? Does the app support data stores other than mongo?
- vmatsiiako 4y agoYes, we're quite familiar with SOC guidelines. We will be including all of Security, Confidentiality, Privacy, Availability, and Processing integrity categories into the SOC 2 examination. I think, given that Infisical is a secret-manager, all of these are very important! Currently, we only support Mongo, although we received requests for some other ones. Which one are you interested in?
- linuxdude314 4y agoAlmost any other standard database would be a better choice: Postgres, MySQL, even Redis. Most companies avoid using MongoDb and lack the staff needed to administer it properly. It’s also hard to find a managed solution for Mongo in most cloud providers.
- Aeolun 4y agoBut you don’t need any cloud provider other than AWS, so why worry about that?
- jd_mongodb 4y agoMongoDB provides MongoDB Atlas, our own managed service. which is supported on every cloud (AWS, Azure, GCP).
- 9dev 4y agoOh, Mongo is a major turnoff. The only sensible data store to support in 2022 and beyond is Postgres, maybe SQLite IMO.
- 3np 4y agoPlain-text (encrypted) files and/or sqlite would be a great complement to whatever else.
- bearzdev 4y agoSQLite/filesystem and etcd or some kind of distributed store. The SQLite and fs option would get you usage in Homelabs. That's a heavy order for the SOC 2, especially if you're just starting out as a company. Imho, it's more important that the code base is audited and the company is transparent.
- hardwaresofton 4y agoPostgres! But better yet you might want to make sure there is an abstraction layer so people can plug stuff in. It’s a extra work but it only gets harder to do later.