This has to do with how our underlying cryptography works; it's end-to-end encrypted by default with opt-out ability for integrations that need it. You'd have t

This has to do with how our underlying cryptography works; it's end-to-end encrypted by default with opt-out ability for integrations that need it. You'd have to manually login to Infisical and grant that permission but the platform itself would be unable to read your secrets otherwise. Technical details: In Infisical, secrets are stored in vaults (we call them projects). They are encrypted symmetrically by vault keys for which there are multiple copies of vault keys encrypted under the public key of each vault member (your teammates). Vault members decrypt their copy of the vault key locally and use that to decrypt secrets (in browser or via CLI similar to platforms like 1Password and Bitwarden); this client-side decryption process makes it impossible for the platform itself to decrypt the secrets itself. What is meant by users having the ability to give permission to Infisical to access/read secrets is to share a copy of the vault key by encrypting it under one of the public keys of Infisical — we employ an abstract concept of "bots" that have public-private key pairs assigned to each vault. When you share a copy of the vault key with Infisical (which can't happen without your explicit action), it grants Infisical the ability to access your secrets for integrations like Vercel, Render, GitHub, etc.