I just noticed while vanished you can access anything with a lock on it. Could you either block this or give it a permission? 

Agreed, this is a must have!

Without granting the permission vanish.abilities.invulnerable vanished players shouldn't be able to access locked boxes/doors.

Right you are. It's using the CanUseLockedEntity hook. But if they're in a base where not every box is locked, they will still be able to loot non-locked boxes.

It should be changed to CanLootEntity and use a dedicated permission.

Bump, i would like to request that too. Including preventing looting corpses or opening doors.
There should exist more "control" on what to allow or not.

Thanks for the suggestions.