Managing secrets after HashiCorp Vault
Vault is still the most capable secrets manager there is. But the BSL relicense, the IBM acquisition, and the shutdown of HCP Vault Secrets have a lot of teams asking what else is out there. Here are eight honest options for handling secrets in CI/CD — and how to choose.
The best Vault alternative depends on what's pushing you off it:
- Want Vault without the BSL/IBM overhang → OpenBao — the open-source (MPL 2.0), API-compatible fork.
- Want modern developer DX → Infisical (open-source) or Doppler (polished SaaS).
- All-in on one cloud → AWS Secrets Manager, GCP Secret Manager, or Azure Key Vault.
- Zero infra, GitOps → SOPS + age (encrypt secret files in Git).
- Just build/deploy-time values → your CI/CD's own encrypted variables — that's where Buddy fits.
First, the threat model
What a secrets tool actually has to do
Before comparing tools, be honest about which of these you need. Most teams need the first three; only some need dynamic secrets and org-wide governance — and that need is what justifies Vault-class weight.
Storage & encryption at rest
Keep secrets out of Git and CI logs, encrypted with a managed key. The baseline every option below clears.
Identity & access control
Who (human or machine) can read which secret, enforced by policy — not a shared .env passed around.
Delivery into CI/CD
Pipelines and runtimes fetch secrets on demand — ideally short-lived and scoped — instead of pasting long-lived tokens.
Dynamic secrets & rotation
Generate short-lived DB/cloud/PKI credentials on demand and rotate automatically. Vault's signature strength; not everyone needs it.
Audit & revocation
Every access logged; leaked secrets revoked centrally. Essential for compliance, overkill for a two-person side project.
Blast radius
When one secret leaks, how far does it reach and how fast can you contain it? Scoping and rotation shrink the answer.
Why teams are reassessing
What's pushing teams off Vault in 2026
Vault didn't get worse — its context did. Four changes stack up.
HCP Vault Secrets shut down
The easy managed SaaS reached end-of-sale June 30, 2025 and end-of-life July 1, 2026. Adopters must migrate to self-run Vault or the pricier HCP Vault Dedicated.
BSL relicense
Since August 2023 Vault ships under the Business Source License — source-available, not OSI open-source, with commercial-use restrictions. Vault 1.14.8 was the last MPL release.
IBM ownership
IBM closed its ~$6.4B acquisition of HashiCorp in February 2025. Reasonable roadmap and support questions follow any acquisition of this size.
Operational weight
HA, auto-unseal, a storage backend, upgrades and policy sprawl — Vault is a system you operate. Namespaces (multi-tenancy) are Enterprise-only.
The options
8 ways to manage secrets instead of (or alongside) Vault
Ordered by how naturally they replace Vault for a team leaving it — starting with the closest drop-in. There's no single winner; the right pick follows your threat model above.
The MPL 2.0 fork of pre-BSL Vault under Linux Foundation governance (v2.5.0, Feb 2026). API-compatible, and namespaces are free (Enterprise-only in Vault). openbao.org
MIT-core, self-host or cloud, excellent CLI/K8s/CI ergonomics. Free ≤5 identities; Pro $18/identity/mo — watch that an "identity" counts machines too.
Polished, cloud-only, dead-simple CI/CD sync. Free ≤3 users; Team ~$21/user/mo adds RBAC, SSO, rotation. No infra to run.
AWS Secrets Manager, GCP Secret Manager, Azure Key Vault. Native IAM, minimal setup — if you're already all-in on one cloud. Trade-off: lock-in.
Extends the 1Password vault to CI/CD via Connect/SDK. Included with Business ($7.99/user/mo annual). Great if humans + machines share one source of truth.
Secrets Manager: open-source, generous free tier (unlimited secrets, 2 users, 3 machine accounts). Teams $6/user/mo. Budget-friendly.
Encrypt secret files in place and commit them to Git; decrypt in CI with a key. Free/OSS. No dynamic secrets or central audit — key distribution is on you.
Managed multi-cloud secrets with Zero-Knowledge encryption, hybrid gateways and dynamic secrets. Custom pricing + free community tier. Enterprise-leaning.
Side by side
Vault and its alternatives, compared
HashiCorp Vault is the anchor row for reference. Figures compiled July 2026 from each vendor's official pricing pages; models change often.
| Tool | License | Hosting | Pricing model | Dynamic secrets | CI/CD delivery | Best for |
|---|---|---|---|---|---|---|
| HashiCorp Vault | BSL 1.1 (src-available) | Self-host / HCP Dedicated | Free CE · Enterprise quote · Dedicated from $450/mo | ✓ best-in-class | ✓ via agent/API/OIDC | Large platform teams needing everything |
| OpenBao | MPL 2.0 (open-source) | Self-host | Free (LF project) | ✓ | ✓ Vault-compatible | Vault users wanting a truly OSS drop-in |
| Infisical | MIT core | Self-host / cloud | Free ≤5 identities · Pro $18/identity/mo | ✓ (Enterprise) | ✓ CLI/operator | App teams wanting modern DX |
| Doppler | Proprietary | Cloud only | Free ≤3 users · Team ~$21/user/mo | partial (rotation) | ✓ integrations | Zero-ops managed secrets |
| AWS / GCP / Azure | Proprietary | Cloud only | $0.40/secret · $0.06/version · $0.03/10k ops | partial (rotation) | ✓ native IAM/OIDC | Teams all-in on one cloud |
| 1Password | Proprietary | Cloud + Connect | Business $7.99/user/mo | ✗ | ✓ Connect/SDK | Human + machine secrets in one vault |
| Bitwarden SM | Open-source | Cloud / self-host | Free tier · Teams $6/user/mo | ✗ | ✓ CLI/SDK | Small teams / tight budgets |
| SOPS + age | MPL / BSD (OSS) | Files in Git | Free | ✗ | ✓ decrypt in CI | GitOps / Kubernetes, no server |
| Akeyless | Proprietary | SaaS + gateways | Custom + free community tier | ✓ | ✓ | Enterprises wanting Vault-class SaaS |
Pricing models and free tiers change often — check each vendor for current terms. Compiled July 2026 from each vendor's official pages.
Official pages: HashiCorp Vault · OpenBao · Infisical · Doppler · AWS Secrets Manager · GCP Secret Manager · Azure Key Vault · 1Password · Bitwarden SM · SOPS · Akeyless
How to choose
Stay on Vault, or move?
A fair call — Vault is still the right answer for a lot of teams.
Stay on Vault (or move to OpenBao) if…
- You genuinely use dynamic secrets, PKI, and transit encryption across many services.
- You have platform engineers to operate HA, unseal, upgrades and policy.
- Multi-cloud and vendor neutrality matter — OpenBao gives you the same model, open-source.
- You're mid-migration and API compatibility saves real work.
Switch to a lighter option if…
- You mostly need to store and deliver static secrets — Doppler, Infisical or Bitwarden are far less to run.
- You're one cloud only — the native secret manager is simplest.
- You want secrets versioned in Git with no server — SOPS + age.
- Your real need is just build/deploy-time config — use your CI/CD's encrypted variables (see below).
Where a CI/CD platform fits
How Buddy handles secrets — and where it doesn't
None of the above replaces your CI/CD platform, and your CI/CD platform doesn't replace them. Buddy is the consumer of secrets, not a vault. It stores encrypted pipeline variables for build- and deploy-time values (workspace, project or pipeline scoped), and it can pull secrets from your store — Vault, OpenBao, a cloud KMS — via integrations and OIDC at run time, so you never paste long-lived credentials into a pipeline.
The honest boundary: for dynamic database or cloud credentials, PKI, app-runtime secret distribution, and org-wide rotation and audit, you still want a real secrets store from the list above. Buddy is where those secrets get used safely in your builds and deployments — SOC 2, encrypted at rest, scoped per pipeline.
Common questions
Secrets management — common questions
Is HashiCorp Vault still open source?
Not in the OSI sense. In August 2023 HashiCorp relicensed Vault from MPL 2.0 to the Business Source License (BSL 1.1). Vault 1.14.8 was the last MPL release; everything since — including 2026 releases — is source-available under the BSL, which restricts competing commercial use and converts to open source four years after each release. If you need a truly open-source, API-compatible option, OpenBao is the fork of pre-BSL Vault.
What happened to HCP Vault Secrets?
HashiCorp discontinued the standalone HCP Vault Secrets SaaS: end-of-sale was June 30, 2025 and end-of-life is July 1, 2026. Existing customers are pointed to Vault Community Edition (self-hosted) or the pricier HCP Vault Dedicated. Teams who adopted the easy managed product now have to migrate — the biggest single reason people are re-evaluating their secrets stack in 2026.
What is the closest drop-in alternative to Vault?
OpenBao. It was forked from Vault 1.14.0 before the BSL change, keeps API compatibility, and is MPL 2.0 under Linux Foundation governance (v2.5.0, February 2026). Multi-tenant namespaces — an Enterprise-only feature in Vault — are included free. Most Vault clients and workflows keep working with minimal changes.
Do I even need a dedicated secrets manager for CI/CD?
It depends on scope. If you only need build- and deploy-time values (API tokens, deploy keys), your CI/CD platform's own encrypted variables cover it. Once you need dynamic secrets (short-lived DB/cloud credentials), central rotation, per-app access policies and audit across services, you want a real secrets store — Vault, OpenBao, Infisical, Doppler or a cloud KMS — and you have your pipeline read from it at run time rather than storing long-lived secrets in the pipeline.
Which Vault alternative is cheapest for a small team?
For a self-hosted, fully open-source option, OpenBao and SOPS + age cost nothing but your own infrastructure. Among managed options, Bitwarden Secrets Manager has the most generous free tier (unlimited secrets, 2 users, 3 machine accounts) and Teams at $6/user/mo; Doppler is free up to 3 users. Watch identity- or seat-based pricing — Infisical bills $18 per identity, counting machines — as your pipeline count grows.
Are the cloud secret managers (AWS, GCP, Azure) good enough?
If you're all-in on one cloud, yes — they integrate with native IAM and are simple to adopt. AWS Secrets Manager charges $0.40 per secret per month plus API calls (no free tier), GCP Secret Manager $0.06 per active version per month (first 6 free), and Azure Key Vault $0.03 per 10,000 operations with no per-secret fee. The trade-offs are cloud lock-in and weaker multi-cloud / dynamic-secret stories than Vault or OpenBao.
How does Buddy fit into secrets management?
Buddy is a CI/CD and platform-engineering platform, not a secrets vault. In the secrets workflow it is the consumer: it stores encrypted pipeline variables for build/deploy-time values, and it can pull secrets from your chosen store (Vault, OpenBao, a cloud KMS) via integrations and OIDC at run time instead of pasting long-lived secrets into the pipeline. For dynamic credentials, PKI, app-runtime distribution and org-wide rotation, you still want a dedicated store from this list.