Security architecture
Two planes. The management plane is how people change values — gated by GitHub, governed by RBAC, fully audited, and written to encrypted storage. The delivery plane is how applications receive values — pulled under a machine identity and served locally from an encrypted, memory-resident daemon. Secrets are never in the repo and never returned to a non-delivery caller.
People only ever reach values through the Keymaster UI, gated by GitHub org/team membership and per-app/per-environment roles, with step-up re-auth for production writes. Inheritance is resolved at read time (production never resolves a non-production value), writes are append/version-only, and every action is audited before it lands. Keymaster stores only metadata — the encrypted values live in Infisical.
Applications never talk to Infisical directly. The keymaster CLI authenticates with a per-environment machine-identity token, pulls a keymaster.export.v1 payload, and (in the preferred mode) serves values from an age-encrypted on-disk snapshot whose decrypt key is fetched into memory only — never written to disk — and exposed to the local app over a peer-authenticated Unix socket.
Infisical's single encryption key is generated once and custodied in 1Password, injected at the host's boot — custody, not a live KMS. Sensitive values are never returned to a non-delivery caller (human or AI tooling), and never appear in logs or error reports.