hashicorp/vault

What Vault does

Vault is a secrets management system for controlling access to API keys, passwords, certificates, database credentials and other sensitive values. It unifies secret access behind one interface, enforces access control, and records a detailed audit log. Rather than expecting every team to build its own key rolling, secure storage and revocation layer, Vault provides those capabilities as a service.

The core model has four parts:

• Encrypted key/value storage: Vault encrypts data before writing it to persistent storage, so raw disk or backend access does not expose secrets. Supported storage includes local disk and Consul.
• Dynamic secrets: Vault can request short-lived credentials from systems such as AWS or SQL databases on demand and revoke them when their lease expires.
• Encryption as a service: applications can send data to Vault for encryption and decryption without Vault storing the plaintext, keeping encryption policy centralized while data stays in the application's own database.
• Leases and revocation: every secret has a lease, clients can renew it, and Vault can revoke an individual secret or a tree of related secrets during key rotation or incident response.

It is aimed at security teams and developers operating distributed systems that need centralized secret access, short-lived credentials and auditable controls. HashiCorp also offers a commercial Vault Enterprise edition.

Build from source

Vault is written in Go. To work on the repository, install Go and set GOPATH plus GOBIN, with $GOPATH/bin on your path. Clone the repository outside the GOPATH, because the project uses Go Modules.

Bootstrap the build tools, then compile a development binary:

make bootstrap
make dev
bin/vault

make dev places the binary in bin and $GOPATH/bin. To include the web UI, run make static-dist dev-ui; the resulting binary is in the same locations README build instructions.

Run tests

Unit tests use make test and require Docker. To test a single package, pass the package path through TEST: make test TEST=./vault. Acceptance tests use make testacc TEST=./builtin/logical/consul; they create and destroy real external resources and may incur real costs, so use a dedicated account acceptance test instructions.

The repository also provides an experimental Docker-based test cluster under github.com/hashicorp/vault/sdk/helper/testcluster/docker for spinning up Vault nodes in tests.

Using and embedding Vault

New users should start with the official Getting Started guides and the Vault documentation. Client examples in several languages live in vault-examples, with a runnable Go sample application.

The repository publishes two importable libraries: github.com/hashicorp/vault/api (HTTP client) and github.com/hashicorp/vault/sdk (plugin and helper SDK). Importing the main github.com/hashicorp/vault module as a dependency is not a supported usage pattern importing notes.

Constraints

• Building and testing from source requires Go and, for tests, Docker.
• Acceptance tests touch real backends and can leave resources behind if a bug occurs; the README recommends a separate account.
• Enterprise-only features, including performance and disaster-recovery replication test helpers, require an Enterprise binary and license.
• The license is reported as NOASSERTION on GitHub; check the repository's license terms before redistribution or commercial use.

HotRepo's take

On the Go daily ranking for 2026-11-13, Vault held the 9th position with 5 new stars that day and totals of 36,505 stars and 4,818 forks. That is a mature project whose ranking presence comes from a steady baseline rather than a growth spike. The 2015 creation date and the scope of the codebase also mean source-level work is mostly repository-internal: configuration, plugins and backend test infrastructure are where contributors can add value, while application integration usually goes through the published api and sdk packages.