Cloud Parts

HCP Vault Radar

A hosted scanner that finds leaked secrets and personal data in code, wikis, tickets and chat, checks which ones still work, and helps move them into Vault.

What it is
Secrets management
Type
Commercial product
Made by
HashiCorp, an IBM company
License
Proprietary: an HCP software-as-a-service; the vault-radar CLI and agent ship as closed-source binaries under a HashiCorp licence agreement
Facts checked
5 October 2026
Website

What it is

Vault Radar is a service in the HashiCorp Cloud Platform (HCP). You connect data sources, such as a GitHub organization, a Confluence site or a Slack workspace, and Radar scans each one in full when it is added, then again on every new commit and pull request. Short-lived scan workers, isolated per project, clone the minimum they need into a temporary directory and look for about 330 secret types, personal data (PII) and non-inclusive language, using patterns, entropy and Base64 decoding. Radar doesn’t keep the secrets it finds: it hashes each value with Argon2id and a per-customer salt, then with a per-project HMAC key, and stores only that hash and where it was found. For sources HCP can’t reach, you run the agent, part of the vault-radar CLI, on Kubernetes or a Linux host in your network. It polls HCP for jobs, scans with credentials that stay local, and uploads only metadata.

What it adds to plain pattern matching is triage. For about 120 secret types Radar calls the issuing service to see whether the secret still works, and it ranks a finding critical when the secret is active and still in the latest version of a file or page, high when it is active but only in history, and low for PII. When the agent is connected to Vault Enterprise or HCP Vault Dedicated, Radar indexes Vault’s KV secrets as hashes and marks leaks that match a secret Vault manages, and from the findings list you can copy a leaked value into a Vault KV path before rotating it. The CLI also runs on its own, in CI pipelines, as a pre-commit hook, or against folders, Docker images, AWS Parameter Store and HCP Terraform variables. Radar grew out of BluBracket, a secret-scanning startup HashiCorp bought in June 2023, and became generally available in April 2025.

Why teams pick it

  • Looks beyond git: Confluence, Jira, Slack, Microsoft Teams, Amazon S3, Docker images, AWS Parameter Store and HCP Terraform variables end up in one inventory
  • Ranks findings by whether the secret still works and is still in the latest version, so triage starts with live leaks
  • Ties into Vault: flags leaked copies of secrets Vault manages and copies leaked values into Vault KV as a first remediation step
  • The hybrid agent keeps data-source credentials and content inside your network; HCP only receives hashes and metadata
  • Pull request checks, pre-commit hooks and CI commands for GitHub, GitLab, Bitbucket and Azure DevOps

Watch out for

  • Proprietary and tied to HCP: there is no self-hosted control plane, and the agent and most CLI scans need an HCP project, which supplies the salt for hashing findings
  • Vault correlation and copying secrets into Vault need Vault Enterprise or HCP Vault Dedicated; Vault Community Edition isn’t supported
  • The free trial covers 2 data sources and 100 resources, with only built-in patterns and Jira and Slack integrations; anything larger needs the paid Essentials tier
  • Fewer detectors than the free TruffleHog: about 330 built-in secret types (Base64 variants included), about 120 with a live check
  • Hard limits and betas: repositories over 2 GB aren’t scanned, a GitHub connection covers 5,000 repositories, and SharePoint, OneDrive, EC2, EBS and HCP Terraform variable scans are beta

Alternatives

What all secrets management have in common →
Cloudflare Secrets StoreBetaCommercialAccount-level secrets that are written once, can never be read back, and are bound by reference into any Worker or AI Gateway that needs them.DopplerCommercialA hosted secrets manager built for developers: one place for every app’s config and secrets per environment, injected with `doppler run` and synced out to clouds and CI.HashiCorp VaultCommercialA secrets server that can mint short-lived database and cloud credentials on demand, not just store passwords.

How it fits with other technologies

Scan a repository’s history against a Vault index, then block new leaks at commit time · bash

# A service principal with the Vault Radar CLI User role in your HCP project
export HCP_PROJECT_ID=... HCP_CLIENT_ID=... HCP_CLIENT_SECRET=...

# Hash every KV v2 secret version in Vault into a local index (beta)
export VAULT_ADDR=https://vault.internal:8200 VAULT_TOKEN=...
vault-radar index vault --outfile vault-index.jsonl

# Clone and scan every reachable commit; findings that match a Vault secret show its Vault path
export VAULT_RADAR_GIT_TOKEN=...   # a GitHub token that can clone the repo
vault-radar scan repo -u https://github.com/acme/payments-api \
    --index-file vault-index.jsonl -o findings.jsonl -f json

# Reject commits that add a finding of high severity or worse
vault-radar install git pre-commit-hook   # needs a Vault Radar licence
mkdir -p .hashicorp/vault-radar
echo '{"fail_severity": "high"}' > .hashicorp/vault-radar/config.json

Vault Radar or a free scanner?#

GitHub, gitleaks and TruffleHog all find secrets in git for free or close to it. Radar’s case rests on the sources outside git, the ranking, and the tie-in with Vault.

HCP Vault RadarGitHub secret scanninggitleaksTruffleHog (open source)
Licence and costProprietary HCP subscription; small free trial, then the paid Essentials tierFree on public repositories; private repositories need the paid GitHub Secret Protection on a Team or Enterprise planMIT, free; the gitleaks-action for GitHub needs a free licence key on organization repositoriesAGPL-3.0, free; a paid TruffleHog Enterprise adds continuous monitoring
Where it looksGitHub, GitLab, Bitbucket, Azure DevOps, Confluence, Jira, Slack, Teams, S3, Docker images, Parameter Store, HCP Terraform variablesFull git history on all branches, plus issues, pull requests, discussions, wikis and secret gists, on GitHub onlyGit repositories, folders and files, and anything piped to stdinGit, GitHub, GitLab, S3, Google Cloud Storage, Docker images, files, Jenkins, Postman, Elasticsearch, Hugging Face
Checks whether a secret still worksYes, for about 120 of about 330 built-in typesYes, when validity checks are turned on: GitHub asks the issuing serviceNo; matches regular expressions with optional entropy thresholdsYes, for over 700 detectors, by logging in to the issuing service
Stops a leak before it landsPre-commit hook, pull request checks, CI commands, pre-receive hooksPush protection blocks pushes on GitHub’s side; on for personal pushes to public repositories, and needs Secret Protection on a repositoryPre-commit hook and a GitHub ActionPre-commit hook, a GitHub Action, and a --fail flag for CI
Link to a secrets managerMatches findings against Vault, AWS Secrets Manager and Azure Key Vault; copies leaked values into Vault Enterprise or HCP Vault DedicatedNone; partner providers are notified of their leaked tokens so they can revoke themNoneNone; trufflehog analyze reports what a found key can access
Where it runsHCP, or an agent or CLI in your network that reports to HCPOn GitHubAnywhere: one binary or containerAnywhere: one binary or container
  • If your code lives on GitHub and your leaks would be in code, GitHub’s own scanning plus push protection covers most of the ground. Radar earns its price when secrets also leak into wikis, tickets and chat, or when you already run Vault Enterprise and want leaks matched against it.
  • The gitleaks maintainer has declared it feature complete: future releases are security patches only.

Ways to run it#

HCP scanning

hosted

Radar’s own workers in HCP clone and scan sources reachable from the internet. Simplest to set up; HCP holds the data-source credentials in its secrets manager.

Agent

in your network

vault-radar agent exec in a Kubernetes deployment or on a Linux host. It polls HCP for scan jobs and keeps credentials local; needed for on-premises sources and for Vault correlation and copying.

CLI

pipelines and laptops

The same binary scans a repo, folder, Docker image or Parameter Store on demand, runs scan ci pr in a pipeline, and installs a pre-commit hook. Most scans need HCP credentials so hashes match across runs.

Editor and AI tools

developer side

A VS Code extension highlights secrets when a file is opened or saved and can copy them into Vault, without talking to HCP. An MCP server lets an AI assistant query a project’s data sources and findings.

See it in a real stack

No architecture uses HCP Vault Radar yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2023–2026

A secrets manager protects only the secrets that are put into it. The rest end up in source code, wikis, tickets and chat, where anyone who can read them can use them. BluBracket, a Palo Alto start-up led by co-founder and CEO Prakash Linga, sold scanning for secrets hidden in “source code, development environments, internal websites, chat services, ticketing systems, and other locations.” HashiCorp announced it had acquired BluBracket on June 27, 2023. HashiCorp’s James Bayer explained why: “we’ve never had the capability to discover and find secrets and then import them into Vault.”

The scanner was rebuilt as a service in HCP and opened as an alpha, HCP Vault Radar, at HashiConf in October 2023. A limited beta followed in January 2024 and limited availability in March; by then Radar checked whether Google Cloud, AWS and GitHub credentials were live and matched findings against Vault. HashiCorp raised the severity of leaks that match a Vault secret because “Most credentials in Vault are used in critical production environments.”

Radar became generally available on April 30, 2025, two months after IBM completed its purchase of HashiCorp, with the ability to copy discovered secrets straight into Vault. The beta matched leaks against Vault Community Edition too; the current documentation limits that to Vault Enterprise and HCP Vault Dedicated.

Why it’s built this way

Keep a hash of each finding, never the secret
A database of every leaked credential would be a target in itself. Radar stores an Argon2id hash, HMACed with a per-project key, so recovering a value needs the original source; matching against Vault works by comparing hashes.
Rank by whether the secret works and is still current
Scanners that only match patterns drown teams in test keys and long-dead credentials. Radar weighs version history, entropy and a live check to put active secrets in current files at the top.
A hybrid agent that only calls out
Many repositories and wikis sit behind firewalls, and security teams don’t want a SaaS holding their credentials. The agent polls HCP for jobs from inside the network, so no inbound access is needed and credentials never leave it.
Check findings against the secrets manager
A leaked value that also lives in Vault is probably a production credential. Matching the two tells a team what to rotate first and where the managed copy is.

Timeline

  1. 2023

    HashiCorp acquires BluBracket in June to add secret scanning

  2. 2023

    HCP Vault Radar alpha announced at HashiConf in October

  3. 2024

    Limited beta in January, then limited availability in March

  4. 2025

    IBM completes its acquisition of HashiCorp in February

  5. 2025

    Generally available in April, with copying of leaked secrets into Vault

  6. 2026

    Slack scanning reaches general availability in CLI 0.41 in January

Sources35 · facts checked 5 October 2026

Improve this page on GitHub