Cracking the Vault: How we found zero-day flaws in HashiCorp Vault
Introduction: when the trust model can’t be trusted Secrets vaults are the backbone of digital infrastructure. They store the credentials, tokens, and certificates that govern access to systems, services, APIs, and data. They’re not just a part of the trust model, they are the trust model. In other words, if your vault is compromised, your infrastructure is already lost. Driven by the understanding that vaults are high-value targets for attackers, our research team at Cyata set out to conduct