fingerprint is an HMAC-SHA-256 of the value keyed with that vault’s own data key, so it is comparable only within one vault: equal fingerprints in one vault mean equal values, and rewriting the same value keeps its fingerprint. The same value stored in two vaults (for example a workspace secret and its intern copy) carries different fingerprints, so comparing fingerprints across vaults cannot show that a copy matches or that a rotation propagated. hosts and fingerprint are null only for legacy rows written before host binding was required; storing the secret again assigns hosts.