How to evaluate whether an Aspire local stack should ship a vault by default or keep vault support optional
Use this when a repo has an Aspire-based local stack and someone proposes adding a vault service/container so secrets are “secure from day one” in local development.
src/UmbracoPrism.AppHost/Program.cs currently keeps the local stack simple: Keycloak container + HTTPS proxy + TestSite/MockBusinessApp wiring, with no vault dependency.src/UmbracoPrism.TestSite/DemoTenantSeeder.cs seeds the repo-owned Keycloak demo tenant with prism-dev-secret.keycloak/realm-export.json contains the matching demo client secret, showing why a default local vault would not materially improve secrecy for this path.src/UmbracoPrism.Core/Models/PrismOidcConfiguration.cs and src/UmbracoPrism.Core/Controllers/TenantManagementController.cs show the real security gap: generic OIDC secrets are still handled as raw values rather than references.