README

Vault    

----

Please note: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, _please responsibly disclose_ by contacting us at [email protected].

----

- Website: developer.hashicorp.com/vault
- Announcement list: Google Groups
- Discussion forum: Discuss
- Documentation: https://developer.hashicorp.com/vault/docs
- Tutorials: https://developer.hashicorp.com/vault/tutorials
- Certification exam: https://developer.hashicorp.com/certifications/security-automation
- Documentation source: https://github.com/hashicorp/web-unified-docs



Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log.

A modern system requires access to a multitude of secrets: database credentials, API keys for external services, credentials for service-oriented architecture communication, etc. Understanding who is accessing what secrets is already very difficult and platform-specific. Adding on key rolling, secure storage, and detailed audit logs is almost impossible without a custom solution. This is where Vault steps in.

The key features of Vault are:

 Secure Secret Storage: Vault can store arbitrary key/value pairs. Vault encrypts data before writing it to persistent
  storage, so gaining access to the raw storage isn't enough to access
  your secrets. Vault can write to disk, Consul,
  and more.

 Dynamic Secrets: Vault can generate secrets on-demand for some
  systems, such as AWS or SQL databases. For example, when an application
  needs to access an S3 bucket, it asks Vault for credentials, and Vault
  will generate an AWS keypair with valid permissions on demand. After
  creating these dynamic secrets, Vault will also automatically revoke them
  after the lease is up.

 Data Encryption: Vault can encrypt and decrypt data without storing
  it. This allows security teams to define encryption parameters and
  developers to store encrypted data in a location such as a SQL database without
  having to design their own encryption methods.

 Leasing and Renewal: Vault associates a lease with each secret.
  At the end of the lease, Vault automatically revokes the
  secret. Clients are able to renew leases via built-in renew APIs.

 Revocation: Vault has built-in support for secret revocation. Vault
  can revoke not only single secrets, but a tree of secrets, for example,
  all secrets read by a specific user, or all secrets of a particular type.
  Revocation assists in key rolling as well as locking down systems in the
  case of an intrusion.

Documentation, Getting Started, and Certification Exams
-------------------------------

Documentation is available on the Vault website.

If you're new to Vault and want to get started with security automation, please
check out 

Top issues

Latest release

October 22, 2026

SECURITY:

 containers/alpine: Upgrade ca-certificates-bundle to 20261020-r0 to distrust eMudhra intermediate chains.
 containers/UBI: explicitly disallow emSign Root CA and Comodo AAA Services in the CA trust store to distrust eMudhra intermediate chains.
 core/policy: Fixed a cache-key collision vulnerability that could cause policy-name aliases to resolve to the immutable root policy. Root-policy aliases are now explicitly rejected at entity, group, token, authentication-response, and agent-registry policy assignment boundaries. Previously accepted root-equivalent po