Open-source CyberArk alternatives

Infisical is an open-source security infrastructure platform used by teams to manage application secrets, certificates and privileged access. It centralizes secrets and configuration across environments, with versioning, rotation and leak prevention. The stack is TypeScript and Go on PostgreSQL, and the project offers both a hosted Infisical Cloud and a self-hosting option.

Secrets are organized by project and environment, such as development and production, in a dashboard. Secret syncs push values to platforms like GitHub, Vercel and AWS and work with tools such as Terraform and Ansible. Further features include point-in-time recovery, scheduled rotation for databases and AWS IAM, ephemeral dynamic secrets, secret scanning that stops leaks into git, a Kubernetes operator, and an agent that injects secrets without code changes. It also offers honey tokens as decoy credentials and brokered access for AI agents. The repository metadata lists the license as Other, so check it for exact terms.

OpenBao is a software solution for managing, storing and distributing sensitive data such as secrets, certificates and keys. It is a community-led project, run under open-governance principles, that intends to stay available under an OSI-approved open-source licence, currently MPL-2.0.

The README describes the problem it targets: modern systems need many secrets, including database credentials, API keys for external services and credentials for service-to-service communication, and tracking who accesses what is hard without a dedicated tool. OpenBao encrypts key/value secrets before they reach persistent storage, so access to the raw storage alone does not expose them. It can write to disk, PostgreSQL and other backends, and it can generate dynamic secrets on demand for systems such as AWS or SQL databases.

OpenBao is written in Go and is widely known as a fork of HashiCorp Vault, which makes it a candidate for teams looking for an open-governance alternative in that space. It runs on your own infrastructure, and the project coordinates through a mailing list, GitHub Discussions and chat channels, with working groups for areas such as namespaces and the UI.