What is Credential Vaulting?

A vault typically encrypts secrets at rest, controls exactly which service or person can retrieve which secret, logs every access for audit purposes, and supports rotating a credential without requiring every dependent system to be manually updated at the same moment. This is fundamentally different from just keeping a `.env` file out of git — a real vault treats secret access itself as an auditable, permissioned operation, not just a storage location. The risk vaulting addresses is concrete: a leaked API key in a git history, a hardcoded password in a config file that gets shared, or a token sitting in plaintext on a server that gets compromised are all extremely common real-world breach vectors. Vaulting doesn't prevent every attack, but it shrinks the blast radius — a compromised application server doesn't necessarily expose every credential it depends on if those credentials are fetched at runtime rather than baked in. Key rotation is the feature that separates a mature vaulting setup from a basic one: being able to issue a new credential and retire the old one on a schedule, with a brief overlap window so in-flight operations don't break, is what makes rotation operationally realistic rather than a risky manual fire-drill.