Secrets spread across config files have no record of who read them and no easy way to revoke them. HashiCorp Vault is a server that hands secrets only to authenticated clients, checks policies, logs every access and can create short-lived dynamic credentials. Use it when many services need database or API credentials and you want each one to get its own. Do not confuse it with Ansible Vault, which only encrypts files with a password so they can sit in git.