But if I have access to the code, then I can get the algorithm used, and I have the key then I can reverse it. (For this reason lots of online password checking uses a one-way hash like bcrypt.)
So I'm trying to work out why a product like Hashicorp Vault (for which the code is open source) is 'more secure' than writing my own Java two-way hash. Can't I just read the Vault source code, get the key and the hashing function and decrypt all the secrets?
My question is: What makes storing secrets in Hashicorp Vault different to using a two-way hash in Java?