Nicely Done, Infisical. This Is the Ad I Want to See More Of.

My last post was about a Meta ad on a subway platform and what it was designed to do to the people looking at it. This one is about a subway ad I liked. Same system, same kind of real estate, and I liked it enough to photograph it twice.

It's a strip above the windows, the long narrow slot that usually holds a dermatologist or a personal injury lawyer. Yellow background, a dark band, and one line of monospaced text:

1  + API_KEY=dGhpcyBpcyBub3cgYSBwdWJsaWMga2V5

Under it, in small type: infisical.com/403. That's the whole ad. No tagline. No logo bigger than the URL. Nobody smiling, no mascot, and nowhere on it the word AI.

What it says, if you can read it

If you've never used git, that line is noise. You look at it for a second and go back to your phone. The ad costs you nothing.

If you have, you read it instantly, because it's a diff. The 1 is a line number. The green gutter and the plus sign mean a line was added. Someone just committed an API key to a repository. Every developer has either done this or caught a colleague doing it. It's the oldest mistake we have, and it still happens on an industrial scale: GitGuardian counted nearly 29 million new hardcoded secrets pushed to public GitHub in 2025 alone, up a third on the year before.¹

Then there are the layers underneath, for anyone who keeps looking.

The key is base64. Decode it and you get: this is now a public key.

The URL ends in 403, the HTTP status for Forbidden. Follow it and there's no product page. There's a small browser game called "ttl: access forbidden", billed as a fictional security challenge, with a single instruction: rotate every key before the fuse burns out.^2* Which is, again, the product pitch, delivered as a toy for exactly the kind of person who would follow a 403 to see what's behind it.

Why I like it

Three things.

It's written in my language, and it trusts me to read it. It doesn't explain the joke. It doesn't say "Stop leaking secrets!" over a stock photo of someone in a hoodie. It shows me the precise moment the product exists to prevent, in the form I'd actually see it in, and assumes I'll get the rest on my own. Being trusted to get a joke is a small thing. It's also rarer in tech advertising than it should be.

It filters honestly. Tech ads on the New York subway were up 50 percent in the first quarter of this year and now make up about one in seven of everything on the system.³ The house style is a big abstract promise aimed at everybody and landing on nobody. Two comedians got five million views this summer by putting up fake ones ("What if forks were spoons?") that commuters could not tell from the real ones.⁴ The Infisical line is the opposite tactic. It's aimed at maybe one person in the car, and it tells that one person something true.

It is the product. The Muse ad showed a plushie, because the product is an agent that reads your email and spends your money, and a plushie makes you forget that. The Infisical ad shows a leaked key, because the product is a secrets manager, and a leaked key is the reason you would want one. One ad hides what the thing does. The other ad is what the thing does.

That last one is the point I was making about Meta from the other direction. I asked for honesty proportional to power. Here it is, in one line of monospace, from a company that could have run a mascot and didn't.

The usual disclaimers

I don't use Infisical and this isn't a review. My own secrets live in 1Password and the OS keychain, and the standards harness my repos run under has a rule that every key gets a 1Password item the moment it's collected. That rule exists because I know exactly how a key ends up in a commit. It's never malice. It's a Tuesday.

I also can't tell you whether the ad works, in the sense of selling anything. The CEO of one of the startups papering the subway told Semafor that a train ad builds a subconscious impression rather than a measurable return. Maybe. I can tell you it worked on me in the only way an ad on a train can. I looked up, I read it twice, I took two pictures, and I went to the URL.

More of this, please

If you're going to put a tech ad in front of me on a train, this is the bar. Say one true thing, in the language of the people you're selling to, and trust them to get it. Skip the mascot. Skip the word AI unless it's the actual product. Make the URL the punchline if you can.

Nicely done, Infisical. Meta, the offer still stands: lose the fur.