By the numbers

A quantitative snapshot of the hashicorp/vault repository. Data collected on 2026-04-30 against commit 9ab8c87 on main.

Size

xychart-beta horizontal
    title "Lines of code by language (excluding tests)"
    x-axis ["Go (non-test)", "Go (tests)", "UI: JS/TS/HBS/SCSS"]
    y-axis "Lines" 0 --> 400000
    bar [390020, 310627, 33738]

File class	Count
*.go total	2,235
*.go non-test	1,462
*_test.go	773
UI .js files (ui/)	1,674
UI .ts files (ui/)	495
UI .hbs (Handlebars templates)	730
UI .scss	91

The Go test-to-code ratio is roughly 0.79 — Vault is unusually well-tested for a project of this size.

Largest source files

The size of these files is itself a signal of where complexity lives.

File	Lines
vault/logical_system.go	7,766
vault/core.go	5,042
vault/token_store.go	4,370
command/server.go	3,480
vault/request_handling.go	3,140
vault/expiration.go	3,116
vault/login_mfa.go	3,122
http/handler.go	1,755
vault/raft.go	1,582
vault/identity_store.go	1,526
vault/router.go	1,144

Activity

Metric	Value
Total commits on main	23,309
Commits in the last 90 days	739
Commits in the last year	2,186
First commit	2015-02-24
HEAD commit	2026-04-29

Churn hotspots — top files changed in the last 90 days

These paths changed in the most commits since the wiki commit's 90-day window:

File	Commits
go.mod	52
go.sum	49
ui/pnpm-lock.yaml	20
vault/consumption_billing_util.go	19
ui/package.json	18
vault/consumption_billing.go	17
vault/billing/billing_counts.go	16
vault/logical_system_use_case_billing.go	15
vault/request_handling.go	12
.github/workflows/build.yml	11
vault/core.go	10
ui/app/components/page/namespaces.hbs	10
vault/identity_store.go	8

The recent activity skews toward billing/consumption and namespace UI work.

Bot-attributed commits

In the last year, 940 commits (about 43% of the 2,186 commits) were authored by Vault Automation, and another 725 commits (about 33%) by hc-github-team-secure-vault-core. Both are HashiCorp service accounts that drive backports, dependency bumps, and CI maintenance. This is a lower bound on automated work — many human-authored commits are also generated or assisted by tooling — but it shows a heavy reliance on bots for the merge-train.

The remaining ~24% (≈521 commits) are spread across HashiCorp staff and outside contributors.

Complexity

Vault has a few "god files" that any contributor will eventually touch:

• vault/core.go at 5,042 lines defines the Core type and most of the unseal/seal/HA lifecycle.
• vault/logical_system.go at 7,766 lines holds the sys/ backend that powers the vault sys API surface.
• vault/token_store.go at 4,370 lines implements the entire token issuance, revocation, and renewal subsystem.
• vault/login_mfa.go at 3,122 lines is the login-time MFA orchestrator.

Average size of vault/*.go (non-test) files is roughly 1,400 lines — large by Go community norms but consistent across the package.

Workflows and CI

.github/workflows/ contains 33 GitHub Actions workflows. The biggest by line count are:

Workflow	Approximate size
build.yml	37 KB
test-go.yml	33 KB
test-run-enos-scenario-matrix.yml	23 KB
ci.yml	21 KB
test-ui.yml	9 KB

Vault uses Enos (under enos/) for end-to-end scenario testing on real cloud infrastructure.