vault

Vault is a secrets management tool from HashiCorp. A secret is anything you want to tightly control access to, such as API keys, passwords, certificates, and similar credentials. Vault provides a unified interface to any secret while offering tight access control and a detailed audit log. Key features described in the README: - Secure Secret Storage: Vault stores arbitrary key/value pairs and encrypts data before writing it to persistent storage, so access to raw storage is not sufficient to read secrets. It can write to disk, Consul, and other backends. - Dynamic Secrets: Vault can generate secrets on demand for systems such as AWS or SQL databases. For example, an application can request credentials for an S3 bucket, and Vault generates an AWS keypair with valid permissions on demand, then automatically revokes it after the lease expires. - Data Encryption: Vault can encrypt and decrypt data without storing it, letting security teams define encryption parameters while developers store encrypted data in places like a SQL database without designing their own encryption. - Leasing and Renewal: Each secret is associated with a lease; at the end of the lease Vault automatically revokes the secret, and clients can renew leases via built-in renew APIs. - Revocation: Vault supports revoking single secrets or trees of secrets, for example all secrets read by a specific user or all secrets of a particular type, which helps with key rolling and locking down systems after an intrusion. The README points to documentation, getting-started guides, tutorials, and a certification exam on HashiCorp's learning platform, plus example repositories for interacting with Vault from applications in different languages and a sample application. For development, Vault is written in Go. The README describes installing Go and setting GOPATH/GOBIN, cloning the repository outside GOPATH, and bootstrapping with `make bootstrap`. Development builds are produced with `make` or `make dev`, and a UI build with `make static-dist dev-ui`. Tests run via `make test` (requires Docker), and package-specific tests can be run with the TEST variable. Acceptance tests are run with `make testacc` and may create, modify, or destroy real resources, so they should be run with care. The repository also documents an experimental Docker-based testing mechanism using the `sdk/helper/testcluster/docker` package, including options for custom binaries and Enterprise licenses. The repository publishes two importable libraries, `github.com/hashicorp/vault/api` and `github.com/hashicorp/vault/sdk`. The README notes that importing the main Vault product as a dependency is not a supported use case. Security issues should be responsibly disclosed to security@hashicorp.com.