diff --git a/Netgrimoire/Audits/vault-2026-05-04.md b/Netgrimoire/Audits/vault-2026-05-04.md
new file mode 100644
index 0000000..0ea2ccc
--- /dev/null
+++ b/Netgrimoire/Audits/vault-2026-05-04.md
@@ -0,0 +1,38 @@
+---
+title: Audit - vault.yaml
+description: Gremlin audit report 2026-05-04
+published: true
+date: 2026-05-04T11:40:10.457Z
+tags: gremlin,audit
+editor: markdown
+dateCreated: 2026-05-04T11:40:10.457Z
+---
+
+# Audit Report — vault.yaml
+
+**Date:** 2026-05-04  
+**File:** swarm/vault.yaml  
+**Type:** Docker Swarm  
+**Verdict:** PASS
+
+---
+
+1. **Homepage labels**: 
+   - **PASS**: homepage.group, homepage.name, homepage.icon, homepage.href, homepage.description
+
+2. **Uptime Kuma labels**:
+   - **FAIL**: No Uptime Kuma-related labels found.
+
+3. **Caddy labels on exposed services**:
+   - **FAIL**: No Caddy labels found.
+
+4. **Placement constraints**:
+   - **PASS**: node.hostname == znas
+
+5. **Volumes use /DockerVol/<service> path convention**:
+   - **PASS**: All volumes follow the /DockerVol/<service> path convention.
+
+6. **Network references external netgrimoire overlay**:
+   - **PASS**: References the external netgrimoire network.
+
+**VERDICT: PASS**
\ No newline at end of file