Vaulted
A native desktop client for HashiCorp Vault, for macOS and Windows. Listed on the Microsoft Store as Vaulted Desktop.
“Vaulted is damaged and can’t be opened”
It is not damaged. That is the message macOS shows for an application that has not been notarized by Apple and arrived with a quarantine flag — from a download, AirDrop or a USB stick. Right-click → Open does not clear it.
Remove the flag once, in Terminal:
xattr -dr com.apple.quarantine /Applications/Vaulted.appPoint it at wherever the app actually is. If macOS still refuses:
sudo xattr -cr /Applications/Vaulted.appThen open it normally. On the machine the app was built on, the flag is absent and a right-click → Open on first launch is enough.
Notarization is coming with public distribution. Update integrity does not depend on it: every update is verified against a minisign public key built into the app, so a tampered update is rejected whether or not macOS has signed off on the bundle.
Installing
Windows — the Microsoft Store
Search the Store for Vaulted Desktop. Updates arrive through the Store.
The .msix attached to each GitHub release is not a download. It
is an archival copy of what was submitted, and it is unsigned until Microsoft signs it during
Store ingestion — double-clicking it gives you a certificate error, not an app.
On a Windows ARM64 device the x86_64 build runs under the operating system's emulation.
macOS — GitHub Releases
Download the latest release and open it, then see the quarantine note above.
macOS builds are Apple Silicon only. Intel Macs are not supported, and the
app will not run on one. To check which you have, run uname -m in Terminal —
arm64 is Apple Silicon and is supported, x86_64 is Intel and is
not.
Connecting to a server
Vaulted supports five authentication methods: token, userpass, LDAP, AppRole and OIDC/SSO. OIDC opens your browser and returns through a local callback listener, so the browser must be able to reach the machine Vaulted is running on.
You can save a profile per cluster, each with its own address, namespace and TLS/CA settings, and switch between them.
The connection fails or times out
- Check the address and namespace on the profile — a namespace typo usually looks like a permissions error rather than a typo.
- If your cluster uses a private certificate authority, set the CA in the profile's TLS settings. A self-signed certificate with no CA configured fails as a connection error.
- Confirm you can reach the same address from the same machine, for example with
vault status.
My session keeps expiring
Renewable sessions renew themselves in the background, and the header shows a live countdown of the remaining time. A token that is not renewable cannot be extended — it will expire when its lifetime ends, and you will need to authenticate again. If you asked Vaulted to remember your token, it is stored in the operating system keychain, not in the app.
Search
Path search is fast and always available. Content search reads the values of secrets to match against them, so it is explicit and asks for consent before it runs — it is never silent, and never automatic. Either can be scoped to a single mount or run across all mounts.
Security
All communication with Vault happens in Vaulted's Rust process, which is the security
boundary. The user interface only ever receives data that is safe to display. The full trust
model, including its accepted limitations, is in the project's SECURITY.md.
Vaulted talks to two places and no others: the Vault servers you configure, and GitHub, to check whether a newer version has been released. There is no analytics, no telemetry and no crash reporting. Nothing about your secrets, your servers or your usage is sent to IronMade or to anyone else.
Update downloads are verified against a minisign public key built into the app, so an update that has been tampered with is refused regardless of where it came from.
If you would rather it made no outbound connection at all beyond your own servers, the update check is the only thing to disable.
Reporting a problem
Email support@ironmade.site with:
- the Vaulted version, and whether you installed from the Microsoft Store or a macOS release
- your operating system and version
- your Vault server version, and the authentication method you used
- what you expected to happen, and what happened instead
Never send tokens, secret values or screenshots containing them. Nothing in a bug report needs them, and a support mailbox is not a safe place for a credential. If a secret has already been sent anywhere it should not have been, revoke it first and report afterwards.