Helix Vault

You reference secrets. You never read them.

Vault is not a place to fetch secrets from — it is a broker that uses them on your behalf. A value goes into one command's environment at the moment it runs, and nowhere else. The command line, the tool output and the transcript never hold a plaintext value; the audit log holds the name and the fact it was used.

There is no reveal. Not for you, not for anyone. If you find yourself wanting the value itself, the answer is one of the two paths below, or the task changes.

Setup

Call the binary by its full path every time: