An attacker who reads the repository, or who owns the server, learns things without decrypting anything: who your members are, what your vaults are called, what your secrets are named, how big each one is, and, in server mode, who asked for what and when.
Two optional mitigations:
Opaque paths. Secret names are stored as unreadable hashes. Members can still browse normally; a repository reader sees nothing meaningful. The cost is that your git diffs stop being human-readable for that vault, which is a real loss.
Size padding. Values are padded up to fixed size steps, so how big an encrypted file is only tells an observer a range, never the exact length. This is on by default when you use opaque paths and off otherwise, because concealing a value's length is pointless when its name is prod/stripe/api_key right next to it.
Neither hides when you access things, or how often a secret is rotated. If your access patterns are themselves sensitive, serverless mode leaks less, at the price of no read auditing.