# HashiCorp Vault

> HashiCorp's secrets manager and encryption service; BUSL-1.1 source-available, free to self-host

**Category:** DevOps  
**Pricing:** source-available  
**URL:** https://developer.hashicorp.com/vault  
**GitHub:** https://github.com/hashicorp/vault  
**Added:** 2026-10-21

---

## The Hook

Vault stores and hands out secrets: static keys, short-lived database and cloud credentials, certificates, and encryption as a service, all behind policies and an audit log.

## What's Good

Release v2.2.0 (2026-10-15), commit on 2026-10-20. ★~36k over eleven years (~60 a week). Useful when you want apps and CI to fetch short-lived credentials instead of long-lived secrets in env files, with one place to revoke and audit them.

## The Catch

License first: Vault 1.15.0 and later are under BUSL-1.1, which is source-available, not open source. You may use it in production and host it for your own organization. You may not offer it to third parties as a paid hosted or embedded product that competes with IBM's paid Vault. Each version becomes MPL-2.0 four years after release. GitHub shows NOASSERTION; read the LICENSE file. Some features, such as namespaces and performance replication, are Enterprise-only. Running it well (unsealing, HA storage, backups) takes real ops work. OpenBao is the MPL-2.0 fork.

## Verdict

The reference secrets manager and fine to self-host internally; pick OpenBao if you need open source.