Secret sprawl, where companies store authentication credentials and similar sensitive data across multiple locations, is a real and growing problem for any company wanting to avert a security breach.

Companies might have hundreds of secrets -- such as API keys, passwords or database access tokens -- spread across their infrastructure, making it difficult to keep tabs on what is stored where, who has access to it, and whether any of this data has inadvertently found its way into the public realm. By way of example, back in 2017, Uber revealed a major breach that exposed the personal data of some 57 million customers, and while there were many security failures at play, the root cause stemmed from hackers that found an AWS access key in a GitHub repository of an Uber developer.

And it's against that backdrop that we've seen a slew of startups and Big Tech tools go to market designed to help companies manage their secret sprawl. The latest is a San Francisco-based company called Infisical, which today announced it has raised $2.8 million in a seed round of funding led by Google's Gradient Ventures to help companies of all sizes centralize their secret management.

Top secret

Infisical is pitching itself as a holistic secret-management platform combining all the components a company needs -- a bit like what Rippling has been doing in the workforce management space, except for secrets, according to Infisical co-founder Vlad Matsiiako.

"As companies are becoming more digital and integrated with other software, it’s harder to manage all of their application and developer secrets -- they have to buy multiple tools and give all of them access to their secrets, which is a security concern on its own," Matsiiako explained to TechCrunch. "You can think of Infisical as an all-in-one secret management stack that combines all related product verticals for a company."

This includes a dashboard for managing secrets across different projects and environments; client SDKs; a command line interface (CLI); native integrations with the likes of GitHub, Netlify and Vercel; secret versioning and "point-in-time recovery"; audit logs; and secret scanning.