🔐 Vault Clone - Redacted Secret Browser with Approval Workflow

Browse OpenBao/HashiCorp Vault secrets without exposing values. Request secret updates via Slack approval workflow.

Let your team see secret KEYS without exposing VALUES. Update secrets via approval workflow.

OpenBao/Vault has a major UX issue: There's no way to show users which secrets exist (keys) without also showing the secret values.

This creates a dilemma:

• ❌ Option 1: Give team access to Vault → They see ALL secret values (security risk!)
• ❌ Option 2: Lock down Vault → Team has no visibility, constantly asks "what secrets exist?"
• ❌ Option 3: Maintain a separate documentation → Gets out of sync instantly

Real-world scenario:

• Developer: "Does the prod/api/ path have a DATABASE_URL secret?"
• DevOps: Has to manually check Vault and tell them
• Developer: "Can you add a REDIS_URL secret?"
• DevOps: Manually adds it

This doesn't scale.

Vault Clone solves this with:

1. 📖 Read-Only Mirror: Auto-syncs secret paths and keys from OpenBao/Vault every 5 minutes
2. 🔒 Redacted Values: Shows secret keys but redacts all values (shows only first/last char hints)
3. 🔍 Searchable UI: Team can browse, search, filter all secrets without security risk
4. ✅ Self-Serve Updates: Request new secrets via web form → Triggers Slack approval → Auto-executes
5. 🔐 Google OAuth SSO: Only authorized domain can access
6. 🎯 Zero Secrets Stored: Values are redacted at ingest, never stored in memory or disk

# Values are redacted BEFORE storage - original values NEVER touch this app
def redact_value(value: str) -> str:
    """Redact secret, showing only first/last character hints."""
    if len(value) <= 4:
        return "***"
    return f"{value[0]}***{value[-1]}"  # e.g., "p***d" for "password123"

Even if someone hacks this app's database, they get nothing.

OpenBao Vault (read-only token)
     ↓
Sync Service (list + read secrets)
     ↓
Redaction Engine (values → "p***d")
     ↓
Local Database (keys + redacted values)

User → Google SSO Login → Browse UI
  ↓
Search: "DATABASE_URL"
  ↓
Results show:
  ✅ Path: prod/api/config
  ✅ Key: DATABASE_URL
  ✅ Value: p***d (redacted)
  ✅ Last Updated: 2026-06-20

Team can now:

• See which secrets exist
• Know the exact secret key names
• Know where secrets are located
• Search across all secrets
• WITHOUT seeing actual values!

User clicks "Add Secret" → Fill form:
  - Path: prod/api/config
  - Key: REDIS_URL
  - Value: redis://...
  - Reason: "New caching layer for API"
     ↓
Form submits to Approval Handler (Slack integration)
     ↓
Approver gets Slack message with [Approve] [Reject]
     ↓
On approval → Argo Workflow executes → Adds secret to OpenBao
     ↓
Next sync (5 min) → New secret appears in Vault Clone

┌─────────────────────────────────────────────────────────┐
│                  OpenBao/Vault (Production)             │
│  Read-only token: Can list + read all secrets          │
└────────────────────┬────────────────────────────────────┘
                     │ (every 5 min sync)
                     ▼
┌─────────────────────────────────────────────────────────┐
│              Vault Clone (This App)                     │
│  ┌──────────────┐  ┌───────────────┐  ┌──────────────┐ │
│  │ Sync Service │→ │   Redaction   │→ │   Database   │ │
│  │ (httpx async)│  │    Engine     │  │   (in-mem)   │ │
│  └──────────────┘  └───────────────┘  └──────────────┘ │
│                                                          │
│  ┌──────────────────────────────────────────────────┐  │
│  │  Web UI (FastAPI + Jinja2 templates)             │  │
│  │  - Browse/search secrets                         │  │
│  │  - View redacted values                          │  │
│  │  - Add Secret form                               │  │
│  └──────────────────────────────────────────────────┘  │
└────────────────────┬────────────────────────────────────┘
                     │ (Add Secret request)
                     ▼
┌─────────────────────────────────────────────────────────┐
│           Approval Handler (Slack Integration)          │
│  Sends approval request to Slack → Approvers decide    │
└────────────────────┬────────────────────────────────────┘
                     │ (On approval)
                     ▼
┌─────────────────────────────────────────────────────────┐
│           Argo Workflow (Auto-Execution)                │
│  Executes: vault kv put secret/path key=value          │
└─────────────────────────────────────────────────────────┘

# BEFORE storage - values never exist in raw form
value = vault.read("secret/prod/db")["password"]  # "SuperSecret123"
redacted = redact_value(value)                    # "S***3"
db.store(key="password", value=redacted)          # Only "S***3" stored

Original value never touches:

• Application memory (beyond read → redact)
• Database
• Logs
• Response payloads

• Only users from ALLOWED_EMAIL_DOMAIN can log in
• Session-based authentication (7-day expiry)
• Signed cookies (no database needed)

The app uses a read-only Vault token:

• ✅ Can list secret paths
• ✅ Can read secret values (for sync only)
• ❌ Cannot write/update/delete secrets
• ❌ Cannot create policies
• ❌ Cannot modify ACLs

All writes go through Approval Handler → Argo Workflow.

logger.info(f"Synced secret: {path}/{key}")  # ✅ OK - no value
logger.info(f"Value: {value}")                # ❌ NEVER - would leak

Updates require:

1. Slack approval from authorized approvers
2. Optional ticket requirement (Jira/Linear)
3. Multi-level approvals for production paths
4. Full audit trail (who requested, who approved, when executed)

• ✅ Auto-Sync: Mirrors all secret paths/keys every 5 minutes
• ✅ Redacted Values: Shows "p***d" instead of "password123"
• ✅ Search & Filter: Find secrets across all paths
• ✅ Path Hierarchy: Browse secrets by folder structure
• ✅ Self-Serve Add Secret: Request form → Slack approval → Auto-execution
• ✅ Google OAuth SSO: Domain-restricted access
• ✅ Responsive UI: Modern web interface (Jinja2 templates)
• ✅ Health Checks: /health endpoint for monitoring

For each secret, shows:

• 🔑 Key Name: Exact secret key
• 📁 Path: Where secret is located
• 👁️ Redacted Value: First/last char hints (e.g., "A***k" for base64)
• 📅 Last Sync: When this secret was last updated from Vault
• 🏷️ Version: Secret version number (if supported)

Users can request:

• Path: prod/api/config
• Key: NEW_API_KEY
• Value: (actual secret - sent only to approver via Slack DM)
• Description: Why this secret is needed
• Ticket ID: Optional Jira/Linear ticket

• Python 3.11+
• OpenBao/HashiCorp Vault instance
• Read-only Vault token
• Google OAuth credentials (for SSO)
• Approval Handler deployed (optional, for self-serve updates)

git clone https://github.com/code-rajeshdeb/vault-clone.git
cd vault-clone

pip install -r requirements.txt

# Vault Configuration
export VAULT_ADDR=https://vault.example.com
export VAULT_TOKEN_FILE=/path/to/token  # OR set VAULT_TOKEN env var
export VAULT_MOUNT=secret               # Vault KV mount point
export SYNC_INTERVAL=300                # Sync every 5 minutes

# Google OAuth (for SSO)
export GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
export GOOGLE_CLIENT_SECRET=your-secret
export GOOGLE_REDIRECT_URI=https://vault-clone.example.com/auth/google/callback
export ALLOWED_EMAIL_DOMAIN=example.com  # Only @example.com emails allowed

# Approval Handler (for Add Secret feature)
export APPROVAL_HANDLER_URL=http://approval-handler:8080

# Session Secret (generate with: openssl rand -hex 32)
export SESSION_SECRET_KEY=your-session-secret-key

# Development
uvicorn main:app --reload --host 0.0.0.0 --port 8000

# Production
uvicorn main:app --host 0.0.0.0 --port 8000 --workers 4

1. Open http://localhost:8000
2. Click "Login with Google"
3. Authenticate with your @example.com email
4. Browse secrets!

docker build -t vault-clone:latest .

docker run -d \
  -p 8000:8000 \
  -e VAULT_ADDR=https://vault.example.com \
  -e VAULT_TOKEN=your-readonly-token \
  -e GOOGLE_CLIENT_ID=your-client-id \
  -e GOOGLE_CLIENT_SECRET=your-secret \
  -e ALLOWED_EMAIL_DOMAIN=example.com \
  vault-clone:latest

Manifests are in k8s/:

# Update k8s/external-secret-*.yaml with your secret manager paths
# Update k8s/deployment.yaml with your config

kubectl apply -f k8s/

Included:

• deployment.yaml - Main app deployment
• service.yaml - ClusterIP service
• external-secret-openbao-readonly-token.yaml - Read-only Vault token
• external-secret-google-oauth.yaml - Google OAuth credentials

Browse Secrets:

1. Login with Google SSO
2. Browse secret paths in sidebar
3. Search for specific keys
4. View redacted values (e.g., "A***k")
5. Know which secrets exist without seeing values!

Request New Secret:

1. Click "Add Secret" button
2. Fill form:
   • Path: prod/api/config
   • Key: NEW_SECRET_KEY
   • Value: (your secret value)
   • Reason: Why you need this
3. Submit → Goes to Slack for approval
4. Wait for approval → Secret auto-added to Vault
5. Next sync (5 min) → Appears in Vault Clone

1. Receive Slack message: "New secret request from @john.doe"
2. See details:
   • Path, key, actual value (in Slack DM only!)
   • Requester, reason, ticket
3. Click [Approve] or [Reject]
4. On approve → Argo Workflow executes → Secret added

Create a read-only policy:

# vault-clone-readonly.hcl
path "secret/*" {
  capabilities = ["read", "list"]
}

path "secret/metadata/*" {
  capabilities = ["read", "list"]
}

Apply:

vault policy write vault-clone-readonly vault-clone-readonly.hcl
vault token create -policy=vault-clone-readonly -period=720h

1. Go to Google Cloud Console
2. Create OAuth 2.0 credentials
3. Add authorized redirect URI:

   https://your-domain.com/auth/google/callback
   

4. Copy Client ID and Secret
5. Set as environment variables

Adjust via SYNC_INTERVAL (seconds):

• 300 (5 min) - Default, good balance
• 60 (1 min) - More frequent updates (higher Vault load)
• 600 (10 min) - Less frequent (lower load)

pytest tests/ -v

curl http://localhost:8000/health
# {"status":"healthy","vault_connected":true,"last_sync":"2026-06-28T10:30:00Z"}

1. ✅ Use read-only Vault token - Never give write access
2. ✅ Rotate token regularly - Set token TTL/period
3. ✅ Domain-restrict SSO - Only allow company email domain
4. ✅ HTTPS only - Always use TLS for production
5. ✅ Network policies - Restrict pod egress to Vault + Google only
6. ✅ Audit logs - Monitor who accesses which secrets
7. ✅ Secret rotation - Use Vault's TTL for automatic expiry

Contributions welcome!

1. Fork the repository
2. Create feature branch (git checkout -b feature/amazing-feature)
3. Commit changes (git commit -m 'Add amazing feature')
4. Push to branch (git push origin feature/amazing-feature)
5. Open Pull Request

MIT License - see LICENSE file.

If you find this useful:

• ⭐ Star this repo
• 🐛 Report bugs via Issues
• 💡 Suggest features
• 💰 Sponsor via GitHub Sponsors

• Approval Handler - Slack approval workflow (used for Add Secret feature)
• OpenBao - Open-source Vault fork
• HashiCorp Vault - Secrets management

• v2.0: Support for multiple Vault backends
• v2.1: AWS Secrets Manager integration
• v2.2: Secret diff view (track changes over time)
• v2.3: Role-based access control (RBAC)
• v2.4: Bulk secret operations
• v2.5: Secret usage analytics

• Issues: https://github.com/code-rajeshdeb/vault-clone/issues
• Discussions: https://github.com/code-rajeshdeb/vault-clone/discussions

Made with ❤️ for DevOps/SRE teams who need secret visibility without security risks.

⭐ Star this repo if it solves your Vault UX problem!