Back to Home

Vault health scan

A free, read-only health check for HashiCorp Vault and OpenBao. Run one command against your install and get a report you can read, share with your team, or send to us for a second opinion. Built for the Vault that has been running for years and that nobody has looked at end to end in a while.

Run the scan Get an expert review

Safe to run against production

It never writes anything to Vault, and it never reads a secret value. Both are enforced in code, not by convention:

  • The scanner's Vault client can only send GET and LIST requests. Any other method is rejected inside the client before a request is built.
  • For KV secrets it reads only /metadata (version, last-updated time), never /data. Tests plant a secret value and fail if it ever shows up in any report format.
  • Our CI runs the full scan against real Vault and OpenBao servers and counts every HTTP method that actually reaches them.

It talks only to your Vault: no telemetry, no call to us or to HashiCorp. A minimal read-only Vault policy ships with it. If your token can't read something, that check is listed as "not checked" and the scan carries on.

What it checks

Every finding comes with a severity, the evidence, why it matters and a concrete fix.

Version & licenseEnd-of-life versions, BSL vs. MPL build, OpenBao detection, Enterprise license.
Seal & unsealShamir vs. auto-unseal, key shares and threshold, sealed status.
HA & storageStorage backend, single-node risk, raft peers, autopilot health.
Audit loggingNo audit device, or only one (a single point of failure).
Auth methodsToken-only or userpass-only setups; AppRole secret IDs that never expire or allow unlimited use.
PoliciesPolicy sprawl, and wildcard or sys/* grants with sudo or write rights.
Token & lease hygieneUnlimited or very long TTLs on mounts and auth methods; lease counts.
Secrets enginesEngine inventory, KV v1 vs. v2, check-and-set settings, secrets untouched for over a year.
TLS, namespaces & backupsListener TLS, Enterprise namespaces, whether automated snapshots are visible.

The report also gives a score from 0 to 100 (the formula is printed next to it), your top five risks, and a "migration readiness" summary: how many of your KV secrets could be imported into Keyorix, and which engines could not.

Run it in five minutes

  1. Download keyorix-migrate for your platform (Linux or macOS, amd64 or arm64) from the GitHub releases page. It's a single binary with a signed checksum and an SBOM. The read-only policy file, healthscan-policy.hcl, is in the same repository.
  2. Create a short-lived, read-only token:
    vault policy write healthscan-readonly healthscan-policy.hcl vault token create -policy=healthscan-readonly -ttl=1h
  3. Run the scan:
    export VAULT_TOKEN=... # the token from step 2 keyorix-migrate vault scan \ --addr https://vault.example.com:8200 \ --output ./report
    You get report.html, report.md and report.json. Private CA? Add --cacert ca.pem. Vault namespaces and AppRole login are supported too.

Want an expert to look at the findings?

Free walkthrough. Send us your report.json and we'll go through the findings with you on a 30-minute call: what's urgent, what can wait, and what's fine as it is. The JSON contains findings and configuration metadata only, never a secret value.

Vault Health Assessment. A fixed-price engagement for teams that want the full picture: architecture and topology, policy and access review, secrets-engine hygiene, operational and disaster-recovery risk, and an honest estimate of what your Vault costs you to run each month. You get a written report with ranked findings and concrete recommendations, a one-page executive summary and a live readout call. It isn't a penetration test or a compliance certification, and if moving to Keyorix isn't right for you, the report will say so.

We use your details only to reply to this request. See our privacy policy.