Roadmap

What is built, what is being built now, and what is planned next.

Shipped

Released and running, built between July and October 2026.

14

  • Encrypted storage and key management

    Every secret is sealed in its own AES-256-GCM envelope, under a key hierarchy rooted in a key that lives outside the database and outside the container image.

  • Accounts and sign-in

    Registration with mandatory two-step verification, an independent Google sign-in path, session lifecycle, a request to confirm it is you before sensitive actions, email recovery, and account deletion that waits before it takes effect. Vault skips that request for a session that confirmed moments ago, and for most actions on a device it already knows.

  • Vaults, entries and search

    Vaults, collections and four entry templates. Search that never bulk-decrypts, reveal and copy with a clipboard timer, revision history, and a trash only a person empties.

  • Agent access over REST and MCP

    Scoped, permissioned keys for agents and integrations, a REST API and a remote MCP server behind one authorization service, and an audit trail of every disclosure an agent caused.

  • Passwords Vault generates for agents

    An agent creating a login can ask Vault to choose the password. It comes from a cryptographic generator rather than from the agent, and is handed back once, to the caller that created the entry.

  • Import, backup and export

    KeePass import, a portable encrypted backup that restores onto a clean host, and a plaintext CSV export that warns you before it writes one.

  • Quotas and restricted administration

    Limits on what one account can hold, and an administrator who can suspend an account or lift a quota but can never read a vault.

  • Deployment and operations

    A hardened container, least-privileged database logins, immutable published images, and deploys that are deliberate rather than automatic.

  • Security hardening and adversarial testing

    Platform hardening, then dedicated test suites attacking every trust boundary in the design, closed by a review against the OWASP application security standard.

  • Edge browser extension

    Autofill that matches a page's exact origin and nothing looser, from an enrollment you approve and can revoke at any time.

  • Security activity log

    Vault records more than seventy kinds of security event and keeps them for a year. The account owner reads their own on one page: sign-ins and wrong passwords, reveals, exports, and changes to agent keys, each naming what it touched, beside every secret their agent keys read and every entry they created, changed, or asked to delete. It filters by kind, outcome, surface and date, says how far back it reaches, and downloads as a CSV file, which may first ask the owner to confirm it is them.

  • Password health report

    Which stored passwords are weak, reused, unchanged for over a year, or already in a public breach corpus. Computed on demand, which may first ask you to confirm it is you, and never kept as a digest of your real secrets.

  • Fixes to shipped behaviour

    Corrections to code already in production: client metadata that was not being coarsened, a hostname check that failed instead of refusing, and a backup step no database login could run.

  • Security notifications

    Vault tries to email you when something that could mean someone else is in your account happens: a sign-in from a browser it does not recognise, a recovery or a recovery code used, your second factor set up, turned off, or turned back on, a Google account linked, the account suspended or reactivated, its deletion scheduled or cancelled, and any change to which security emails you receive. No setting turns those off. New agent keys, extensions, exports, signing out everywhere, and repeated wrong passwords email you too, and those you can turn off. Apart from the deletion notice, delivery is retried for up to a day rather than tried once, and no message carries a secret or a link. The deletion notice carries the link that cancels the deletion, and is sent before the deletion is scheduled, which does not happen if it cannot be sent.

In progress

Being built now.

2

  • Rotation reminders

    Record when a credential is due to be rotated, see what is due or overdue while browsing, and be reminded before it matters. An overdue entry keeps working exactly as it did.

    1 of 3 steps complete

  • Command-line client

    Read one secret in a shell script, or run a command with secrets in its environment, without writing an HTTP client first.

    5 of 9 steps complete

Next up

Next once the work above lands. Ordered rather than scheduled: it carries no date.

1

  • Import from CSV, 1Password and Bitwarden

    More ways in than KeePass, including Vault's own CSV export, which it cannot read back today.

Later

Planned in roughly this order, with nothing committed.

6

  • Chrome and Firefox autofill

    The same extension, built from the same reviewed source, in two more browsers.

  • Passkey sign-in

    A third way to prove an account at sign-in and before sensitive actions, alongside the password and second factor.

  • Short-lived credentials minted on request

    Vault keeps a key it never discloses, such as a GitHub App's private key, and exchanges it for a credential that expires within the hour, so an agent never holds the long-lived secret.

  • Tags and favourites

    Organise entries across vaults and collections instead of only inside one.

  • File attachments

    Keep the recovery kit, the certificate or the key file beside the credential it belongs to, encrypted the same way the entry is.

  • Emergency access

    Name a contact who can request access to your vault, with a waiting period you can refuse inside and a grant you can revoke at any time.

Known issues

Open against the current release.

2

  • The extension can show autofill on while it is paused

    Pausing autofill from the website or from another installation takes effect, but an installation's popup can keep saying autofill is on.

  • KeePass import keeps too much and says too little

    Entries already deleted in KeePass come back as live entries, and an entry's history and expiry date are dropped without saying so.

Not planned

Decisions rather than a backlog. These are not coming later.

6

  • End-to-end encryption

    The server is trusted to decrypt what it is authorized to return. Vault is not zero-knowledge and does not claim to be.

  • Agents that delete permanently

    An agent can set an entry aside for review. Confirming a deletion stays with a person.

  • Agents that manage their own vaults

    An agent cannot create a vault, restore what it set aside, or roll an entry back to an earlier version. Between them they would let a stolen key undo a rotation or spend the account's quota, and a person already does all three from the browser.

  • Bulk secret reads

    No endpoint or tool returns more than one entry's secrets, and none ever will.

  • Stored password digests

    The health report keeps a verdict, never a hash of your real passwords. That table would be exactly the thing the feature exists to warn you about.

  • Hardware key custody

    The root key is a file on the host, mounted read-only. No hardware module and no cloud key service.

Last updated 28 October 2026 from the project's issue tracker. What Vault does