Docs review

Solid rewrite that brings the page in line with the AWS Secrets Manager peer convention. Heading hierarchy is fixed, "HashiCorp" is now consistently capitalized, em-dash usage is reasonable across the article, and the Pulumi code chooser is a real improvement on a page that previously promoted Pulumi without showing any. A few things worth a closer look before merge:

Issues

1. "Open-source" framing (line 14)

The intro paragraph for the H2 calls Vault "an open-source tool." HashiCorp relicensed Vault Community Edition from MPL 2.0 to BUSL 1.1 (Business Source License) in August 2023, which the OSI does not classify as open source. "Source-available" is the more accurate label, and several other Pulumi pages have already been updated this way.

HashiCorp Vault is a source-available tool for securely storing, generating, and tightly controlling access to secrets such as tokens, passwords, certificates, and encryption keys. Vault encrypts secrets at rest, brokers access through identity-based policies, and produces a detailed audit log of every access — giving teams a single, centralized way to manage sensitive data across applications, infrastructure, and clouds.

2. Bulleted list interrupted by the language chooser (lines 97–229)

The Conclusion ends with what reads as a three-item bulleted list of next steps, but the chooser block sits between bullet 1 ("Manage Vault as code with Pulumi") and bullets 2–3 ("Centralize secrets…", "Advanced configuration management"). Hugo's renderer is likely to treat that as two separate lists, breaking the visual continuity and the numbering of next steps. Worth confirming in a local build that the three items still render as a single list, or consider restructuring — for example, lift the code chooser into its own "Manage Vault as code with Pulumi" subsection above the conclusion, then keep the next-steps list intact at the end.

3. Em-dash density inside the "What is HashiCorp Vault?" section (lines 14, 20, 22)

Three em-dashes appear within ten lines of each other. The total of four across the article is fine, but clustering three in one short section reads a bit AI-flavored. Consider rephrasing one or two — for example, on line 22:

- **Revocation**: Vault can revoke individual secrets or entire trees of secrets. For example, every credential a compromised application has accessed can be revoked at once.

Minor

• Line 18 mixes "key/value" with the later "KV v2 mount" terminology (line 97). Consider standardizing on one form on first reference, or briefly clarify the relationship (KV is the secrets engine; KV v2 is the versioned variant).
• Line 78: "Rotate Vault's encryption key (rotate) and re-key the master/recovery keys (rekey)" — these are operator subcommands, so wrapping them as vault operator rotate / vault operator rekey would be more discoverable for readers who want to look them up.
• Line 86 introduces "HCP Vault" without expanding the acronym. First-mention expansion ("HashiCorp Cloud Platform (HCP) Vault") would help readers unfamiliar with the term.

Things I confirmed

• Heading hierarchy is now correct (H2 for top sections, H3 for "Key features").
• All four code samples use the right Pulumi Vault provider resources (Mount, kv.SecretV2) with appropriate language idioms.
• The chooser shortcode usage ({{< chooser language \"typescript,python,go,csharp\" / >}} plus {{% choosable language X %}} blocks) follows the pattern used elsewhere in the docs.
• Internal links use the canonical full-path style (/docs/pulumi-cloud/esc/, /registry/packages/vault/).
• First-mention links are present for HashiCorp Vault, Pulumi ESC, the Pulumi Vault provider, and HCP Vault.

If you'd like me to take another pass after these are addressed, mention @claude.

Your site preview for commit 944a4af is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-18813-944a4af0.s3-website.us-west-2.amazonaws.com

Claude finished @CamSoper's task in 2m 20s —— View job

Applied review feedback

Pushed 8bd5f81 addressing the items you flagged plus the BSL fix you asked me to call.

• BSL/source-available (line 14): swapped "open-source" for "source-available" per the Aug 2023 BUSL relicense.
• Marketing tone, line 10: tightened to "is a popular tool for this" — kept the link.
• Marketing tone, line 19: "drastically reducing the blast radius of a leak" → "limiting exposure if a credential leaks".
• HCP Vault link (line 86): dropped the link rather than redirecting to the product page, since line 10 already links the same /products/vault URL at first mention; a second link to the same destination would be redundant. Happy to swap to the product page instead if you'd rather keep a link there.
• Stale vaultproject.io URLs (lines 28, 41): updated to developer.hashicorp.com.

A couple of items from my earlier review I left alone since they weren't in your list and you didn't flag them as blocking — happy to address any of these on request:

• Em-dash density inside the "What is HashiCorp Vault?" section
• KV vs. KV v2 terminology mixing on first reference
• vault operator rotate / vault operator rekey qualifier
• HCP acronym expansion at first mention

Local lint isn't allowed in this sandbox; CI will run it on the new commit.
• Branch: improve/what-is-hashicorp-vault