Changelog

Automatic secret rotation is now enforced org-wide

Every project can now opt into scheduled rotation for database credentials, API keys, and signing certificates. Admins set a maximum age policy once and Vaultline rotates and re-syncs downstream on schedule — no manual runbooks.

• Set a max-age policy (7, 30, or 90 days) per environment
• Zero-downtime handoff with dual-active credentials during the rotation window
• Rotation events stream straight into the audit log and your SIEM

Introducing Vaultline Edge — secrets at the CDN layer

Push encrypted secrets to 300+ edge locations so serverless functions read them locally instead of round-tripping to a central region. Reference resolution drops from ~90ms to under 4ms at the edge.

Edge is available today on Team and Enterprise plans, with a one-line config in your vaultline.yaml.

• Envelope-encrypted replicas, keyed per region
• Automatic invalidation the instant a secret changes upstream
• Works with Cloudflare Workers, Deno Deploy, and AWS Lambda@Edge

A clearer diff view for every secret change

Reviewing a change set used to mean squinting at masked hashes. The redesigned diff view now shows added, removed, and rotated keys side by side, with values masked by default and a single click to reveal for authorized reviewers.

• Grouped by environment so staging and production changes never blur together
• Inline comments and required approvals before a merge lands
• Keyboard shortcuts to jump between changed entries

SCIM 2.0 provisioning and hardware-key MFA

Enterprise teams can now provision members automatically from Okta, Entra ID, or any SCIM 2.0 provider, and enforce WebAuthn hardware keys as a second factor for anyone who can read a production secret.

• Just-in-time deprovisioning — access is revoked the moment a user is removed from your IdP
• Step-up authentication required before revealing a production value
• Passkeys and YubiKeys supported alongside TOTP

CLI 3.0 with encrypted local caching

The rebuilt command line ships secrets to your process in a single call and keeps an encrypted on-disk cache so local builds keep working when you're offline. Fetches are up to 5× faster on cold start.

Redesigned audit-log timeline

The audit view is now a readable timeline instead of a raw table. Filter by actor, environment, or secret, and export any window to CSV or your logging pipeline with one click.