hashicorp/vault

A tool for secrets management, encryption as a service, and privileged access management

36.4k stars · 4.8k forks · Go

At risk

At risk: a high-severity security advisory affects the latest version.

Why

The latest version of Go package github.com/hashicorp/vault has 3 high-severity security advisories (GHSA-72gw-fmmr-c4r4, GHSA-88v5-9hxc-f85r, GHSA-m2w4-8ggf-rj47). (source 1, source 2, source 3, source 4, source 5, source 6, source 7, source 8, source 9, source 10)
One person wrote 99% of human commits in the last year, so the project depends on them continuing. (source 1, source 2)

What would change this

The latest version is patched or the advisory is withdrawn.
A second person takes a substantial share of commits.
Partly checked: maintenance (Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.; Authors in the last 90 days are counted from the sampled commits only.)

Maintenance

Partial

Active

Human commits, 30 days: 362
Human commits, 90 days: 934
Human commits, 365 days: 2.8k
Bot share of commits, 365 days: 0%
Last commit: Oct 13, 2026 (1 day ago)
Last human commit: Oct 13, 2026 (1 day ago)
Authors, 90 days: 6
Last release: Oct 7, 2026 (7 days ago)
Median PR merge time: 2 hours

Responsiveness: of 30 recent issues, 3% got a maintainer reply. Median first response: 8 hours.

Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.
Authors in the last 90 days are counted from the sampled commits only.

Sources: Commits, Releases, Merged pull requests, Issues

People

Complete

Owner: Organization
Commits sampled: 500 since Oct 14, 2025
Authors for half of commits: 1
Authors for 80% of commits: 1
Contributors: 387

Top committers

hc-github-team-secure-vault-core: 99% of commits
roh-a: 0% of commits
akshya96: 0% of commits
kitography: 0% of commits
ncabatoff: 0% of commits

Shares come from the newest sampled commits, since the commit sample is capped.

Sources: Commits, Contributors

Stars

Complete

Mostly organic, confidence high

Bars show stars gained each week. Orange bars overlap a burst.

Bursts

Apr 28, 2015 to May 23, 2015: about 2.1k more stars than usual, peak 621 in one day, a spike that tapers off. Outside explanation: a jump in forks.
Jun 1, 2015 to Jun 4, 2015: about 84 more stars than usual, peak 44 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Jul 28, 2015 to Jul 30, 2015: about 65 more stars than usual, peak 37 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
May 9, 2016 to May 10, 2016: about 78 more stars than usual, peak 46 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Feb 5, 2019 to Feb 8, 2019: about 80 more stars than usual, peak 40 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Jun 26, 2019 to Jul 3, 2019: about 304 more stars than usual, peak 108 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Aug 27, 2019 to Aug 30, 2019: about 124 more stars than usual, peak 48 in one day, a flat block of stars. Outside explanation: a jump in forks, a jump in issues and pull requests.
Jun 16, 2020 to Jun 17, 2020: about 121 more stars than usual, peak 107 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Jul 23, 2020 to Jul 25, 2020: about 591 more stars than usual, peak 308 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Sep 15, 2020 to Sep 17, 2020: about 430 more stars than usual, peak 165 in one day, a flat block of stars. No outside explanation found, so this burst is unexplained.
Feb 9, 2021 to Feb 13, 2021: about 835 more stars than usual, peak 367 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
May 22, 2021 to May 23, 2021: about 371 more stars than usual, peak 330 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Feb 4, 2022 to Feb 5, 2022: about 250 more stars than usual, peak 235 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Mar 2, 2022 to Mar 6, 2022: about 402 more stars than usual, peak 146 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Jul 20, 2022 to Jul 26, 2022: about 482 more stars than usual, peak 149 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Sep 2, 2022 to Sep 2, 2022: about 90 more stars than usual, peak 97 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Sep 22, 2022 to Sep 24, 2022: about 170 more stars than usual, peak 134 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Nov 30, 2022 to Dec 2, 2022: about 180 more stars than usual, peak 99 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Dec 21, 2022 to Dec 22, 2022: about 85 more stars than usual, peak 81 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Mar 31, 2023 to Apr 1, 2023: about 142 more stars than usual, peak 121 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Oct 26, 2023 to Oct 29, 2023: about 200 more stars than usual, peak 99 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Jul 18, 2024 to Jul 21, 2024: about 333 more stars than usual, peak 132 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Jan 27, 2026 to Feb 1, 2026: about 964 more stars than usual, peak 303 in one day, a shape we can't classify. No outside explanation found, so this burst is unexplained.

2 stars GitHub has since removed (tracked since Oct 14, 2026).

Anyone can buy stars for any repo; bursts alone don't prove the owner did.

Some star bursts have no matching forks, issues, releases, or launch coverage.
Anyone can buy stars for any repo, so this describes the star history only.

Sources: How star history is analyzed

Risk

Complete

Flags

High: OSV, via deps.dev, lists GHSA-72gw-fmmr-c4r4, GHSA-88v5-9hxc-f85r, GHSA-m2w4-8ggf-rj47 at HIGH severity on the latest version of github.com/hashicorp/vault. Details
Warning: OSV, via deps.dev, lists GHSA-8r5m-3f66-qpr3, GO-2026-5199, GO-2026-5247, GO-2026-5262, GO-2026-5487 at MODERATE, LOW or unrated severity on the latest version of github.com/hashicorp/vault. Details

License

Now: BUSL-1.1 (not OSI-approved)
A year ago: BUSL-1.1 (not OSI-approved)

Packages

github.com/hashicorp/vault (GO): latest v1.21.4, published Mar 5, 2026
Advisories for the latest version: GHSA-72gw-fmmr-c4r4 (high), GHSA-88v5-9hxc-f85r (high), GHSA-8r5m-3f66-qpr3 (moderate), GHSA-m2w4-8ggf-rj47 (high), GO-2026-5199 (unknown), GO-2026-5247 (unknown), GO-2026-5262 (unknown), GO-2026-5487 (unknown)

Package and advisory data: deps.dev and OSV.

OpenSSF Scorecard: 6.5 out of 10 (via deps.dev).

Sources: GitHub: hashicorp/vault, deps.dev: Go github.com/hashicorp/vault, OSV: GHSA-72gw-fmmr-c4r4, OSV: GHSA-88v5-9hxc-f85r, OSV: GHSA-8r5m-3f66-qpr3, OSV: GHSA-m2w4-8ggf-rj47, OSV: GO-2026-5199, OSV: GO-2026-5247, OSV: GO-2026-5262, OSV: GO-2026-5487

Badge

Add this to a README to show the current verdict:

[![RepoRadar](https://reporadar.ai/hashicorp/vault/badge.svg)](https://reporadar.ai/hashicorp/vault)

Earlier verdicts

Oct 14, 2026: At risk
Oct 14, 2026: At risk
Oct 13, 2026: At risk

Computed 13 hours ago · method 2026.10.2