Vault's weakness is the single shared password, not the AES256 underneath. The senior answer covers rekey ceremonies on offboarding, encrypt_string for readable diffs, labelled vault-ids per environment, and shrinking what needs encrypting at all.
20 answers per topic instead of 10, and your progress kept · no cardor unlock all 390 remaining answers · ₹2,000 / $25