Open source
Vaultlier is built in the open.
The runtime SDK and CLI are open source under the MIT license and developed in public on GitHub. Because the package is what you run in production, we hold it to strict standards — and we welcome contributions that keep it that way.
Ways to contribute
Report an issue
Found a bug or a rough edge? Open an issue with a clear repro. Well-scoped reports are some of the most valuable contributions.
Send a pull request
Fix a bug, add a CLI flag, or improve an error message. Behavior changes ship with tests in the matching *.test.ts file.
Improve the docs
Clarify a guide, fix an example, or document a gotcha. Docs live in the repo alongside the code and review the same way.
Spread the word
Star the repo, share what you built, or help answer questions. Adoption and feedback steer the roadmap.
Ground rules
A few invariants are non-negotiable because they are what make Vaultlier safe to depend on. CI enforces them on every pull request.
Zero runtime dependencies
Everything in the published package ships with no third-party packages. Need a utility? Write the minimal version. Dev dependencies are fine.
Secrets never touch disk or logs
No secret value may be written to a file, echoed to output, or embedded in an error. Tests assert this — keep them passing on new surfaces.
Tests accompany changes
New commands, flags, and error paths need tests. CI enforces lint, type-checks, the suite, coverage floors, and a clean build on every PR.
Get started
- Fork and clone the repo, then run
npm cifrom the root (npm workspaces). - Make your change with tests, and run
npm run lint,check-types,test, andbuildlocally. - Open a pull request. The full workflow and quality gates are in the contributing guide.