aff0gat000/Vaulter

Search and audit HashiCorp Vault KV secrets for non-secret data and misconfigurations.

Trust Signals

workflow.ymlSHA-pinned

uses: aff0gat000/vaulter@f9a9aa3495f96e402ea9681aab175d16cf8677d4 # no releases — HEAD as of 2026-07-10

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
command	Subcommand to run: audit or search.	no	audit
vault-addr	Vault address (sets VAULT_ADDR). Falls back to the VAULT_ADDR env var.	no	""
vault-token	Vault token (sets VAULT_TOKEN). Falls back to the VAULT_TOKEN env var. Use a secret.	no	""
mount	KV engine mount path.	no	secret
kv-version	KV engine version (1 or 2).	no	2
prefix	Path prefix to scan under.	no	""
key	Regex matched against secret keys (search only).	no	""
value	Regex matched against secret values (search only).	no	""
json	Emit JSON output.	no	false
show-values	Show secret values instead of masking them. Avoid in CI logs.	no	false
insecure	Skip TLS verification (not recommended).	no	false
timeout	Vault request timeout (e.g. 30s).	no	30s
fail-on-severity	For audit: fail the job when findings reach this severity (none \| warning \| error).	no	error

no outputs