Hugging Face ditched .env files and HashiCorp Vault to stop secret sprawl after a breach

When a security incident exposed credentials at Hugging Face, the team knew its patchwork of .env files and AWS-specific tooling had to go. They didn’t just need a new vault — they needed to rearchitect how secrets flowed across a multi-cloud infrastructure handling over 10 million requests per minute. The answer wasn’t HashiCorp Vault, which they evaluated and deemed too heavyweight. They chose Infisical.

The migration forced a hard but healthy cleanup. The engineering team split monolithic project structures into distinct infrastructure and application domains, creating a clear separation of concerns that made role-based access control actually enforceable. Their existing identity provider, Okta, now maps groups directly to Infisical permissions: developers keep admin rights over their own projects, while frontend and backend squads get scoped read or write access. That’s a far cry from the old days of shared credential files flying around.

On the Kubernetes side, the Infisical Operator watches for secret changes and syncs them to cluster resources automatically. But Hugging Face engineers made a deliberate choice that reveals the tension between security automation and operational reality. They turned off the Operator’s auto-restart feature for deployments. At their scale, with massive replica counts and relentless traffic, blindly restarting containers on every secret rotation introduces more risk than it removes. They prefer manual redeployment triggers — control over convenience.

For local development, the CLI injects secrets directly into dev environments, killing the insecure local .env file habit entirely. It’s a small workflow change that closes a big attack vector. The platform also gives ML researchers a sanctioned way to share credentials without resorting to Slack messages or plaintext files. What Hugging Face built isn’t just a tool swap. It’s a cultural shift in how a hyper-growth AI company treats the credentials that protect its models, data, and infrastructure — and it started with getting burned.