HashiCorp archives Boundary's open-source repo, ending Community Edition development

HashiCorp ends development of Boundary Community Edition

HashiCorp has archived the open-source repository for Boundary, its tool for identity-based access management on dynamic infrastructure, formally ending the Community Edition of the product. According to a notice posted to the project's GitHub repository, the archival took effect on October 8, 2026, and Boundary CE is no longer under active development.

The company says all future Boundary work will go into HCP Boundary, its managed cloud offering, and Boundary Enterprise, the commercial self-hosted edition. In the notice, HashiCorp positions those products as the place where it can deliver enterprise-grade access capabilities for both humans and AI agents, a phrasing that points toward a roadmap built around agentic access rather than human login flows alone.

The repository is now read-only

The archived repository no longer accepts new issues, pull requests, or community contributions. Existing source code and previously released binaries stay available for reference and for existing self-managed deployments, but nothing further will be merged or shipped from the project.

The sharpest line in the notice concerns maintenance: no new Boundary CE releases, maintenance updates, bug fixes, or security patches are currently planned. That leaves any remaining CE installation as frozen software. It will keep running, but future vulnerabilities in the code will not be addressed upstream.

HashiCorp's own advice to holdouts is direct: teams that continue using Boundary CE should evaluate whether it still meets their operational, security, and compliance requirements. For an access-management product, whose entire function is to gate privileged access to infrastructure, an unpatched deployment is exactly the kind of exposure such an evaluation is meant to surface.

A paid-only path forward

For supported capabilities, HashiCorp points users to HCP Boundary or Boundary Enterprise, citing production-scale governance, compliance, session recording, enterprise support, and all future development. In practice, organizations that want a maintained Boundary now choose between two paid options: the managed HCP service or a licensed Enterprise deployment.

The notice does not mention a community fork or a successor project. Because the code remains publicly visible, a fork is a theoretical possibility, but nothing has been announced, and the archived repository itself cannot accept upstream contributions. The change drew attention after appearing on the front page of Hacker News, where it was read as a straightforward deprecation of the open-source edition rather than a change of license.

Why it matters

For self-managed CE users this is a forced decision: pay for HCP Boundary or Boundary Enterprise, keep running unmaintained security software, or migrate to an alternative. The absence of security patches is the critical factor, since the risk profile of an access broker only grows as known vulnerabilities accumulate, and most compliance regimes expect supported software in the access path.

The move also fits a broader pattern among infrastructure vendors, where free community editions are retired outright and investment concentrates on managed services and enterprise licenses. For teams that adopted Boundary because it was open source, the archival is a reminder that vendor-controlled community editions can be discontinued at will, and that the long-term viability of an open-core product depends on the commercial incentives behind it.