Maintainers

hashicorp/vault is maintained by the Vault engineering team at HashiCorp (now part of IBM after the 2025 acquisition). The repository does not ship a CODEOWNERS file, so the data below comes from the public git history of the last year.

Subsystem (vault/... paths)	Recent contributors (top by commit count, last year)	Last activity
Repo-wide automation, dep bumps, backports	Vault Automation, hc-github-team-secure-vault-core (HashiCorp service accounts)	Every day
Web UI (ui/)	claire bontempo, Jordan Reimer, lane-wetmore	Active
QA, Enos, release engineering	Ryan Cragun	Active
Core, identity, replication	Sarah Chavis, Violet Hynes, Dan Rivera, miagilepner	Active

The full list of contributors who've touched main in the last year is ~100 people; the ten most prolific (excluding bots) account for roughly half of human commits. Per-page contributor bylines aren't tracked here because the repo's churn is dominated by automation and the per-file authorship signal is noisy.

How to reach maintainers

• Bugs and feature requests: https://github.com/hashicorp/vault/issues.
• Security issues: security@hashicorp.com (do not file a public issue).
• Discussion / design: Vault discussion forum.

Bots in the loop

Bot	Role
Vault Automation	Backport bot. Cherry-picks merged PRs to active release/x.y branches.
hc-github-team-secure-vault-core	Dependency bumps and CI maintenance.
dependabot[bot]	Some upstream-dependency PRs.
factory-droid[bot]	Possibly-AI co-author tag (rare in this repo's history).

These accounts are filtered out of the per-page contributor lists since they're not people you'd reach out to with a question.

Project governance

Vault is open source under BUSL-1.1 with a two-year MPL-2.0 conversion. Architectural decisions are made by the HashiCorp Vault engineering team; community proposals are welcome via issues and PRs but the team holds the merge button. The Enterprise edition is built from this same source plus closed-source files; the OSS tree maintains the seams (_ce.go, _oss.go) so Enterprise can drop in real implementations.