02.1
SecretsEncrypted and versioned
AES-256-GCM with a nonce generated per write and every version retained. Reads are audited, so there is no quiet path to a value.
AES-256-GCM
#What it is
Vault unifies three things that are usually three libraries: encrypted secrets, rule-based feature flags, and hot-reloadable runtime configuration. It is a library: you bring the database and the encryption key, and you control the process lifecycle.
#Secrets
AES-256-GCM at rest with transparent decryption on read. Every Set archives the previous value, so any historical version is fetchable by number. The key provider reads from the environment with hex or base64 auto-detection, and secrets carry optional metadata including expiry.
#Feature flags
Five value types (bool, string, int, float, JSON) and six targeting rules: by tenant, by tenant tag, by user, deterministic percentage rollout, a time-window schedule, and a custom rule evaluated by a plugin. Rules evaluate in priority order with per-tenant overrides, behind an LRU cache with a 30-second default TTL. Typed accessors return a default rather than an error, because a flag lookup failing should not take down a request path.
#Runtime configuration
Typed entries with duration parsing, per-tenant overrides resolved ahead of the app-level value, version tracking, and Watch callbacks fired on mutation. Sources compose: memory, environment, database, or a priority chain across all three.
#Cross-cutting
Tenant isolation propagates through context.Context, so a cross-tenant read is structurally impossible rather than merely filtered. Secret rotation runs as a background manager with per-key rotator callbacks, automatic versioning and record-keeping. Every action lands in an append-only audit trail with full scope context, optionally forwarded to an external system.