Bitwarden browser extension vault (Chrome, Firefox, Opera, Edge, Safari, & more).
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

45 lines
2.2 KiB

  1. Bitwarden believes that working with security researchers across the globe is crucial to keeping our
  2. users safe. If you believe you've found a security issue in our product or service, we encourage you to
  3. notify us. We welcome working with you to resolve the issue promptly. Thanks in advance!
  4. # Disclosure Policy
  5. - Let us know as soon as possible upon discovery of a potential security issue, and we'll make every
  6. effort to quickly resolve the issue.
  7. - Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a
  8. third-party. We may publicly disclose the issue before resolving it, if appropriate.
  9. - Make a good faith effort to avoid privacy violations, destruction of data, and interruption or
  10. degradation of our service. Only interact with accounts you own or with explicit permission of the
  11. account holder.
  12. - If you would like to encrypt your report, please use the PGP key with long ID
  13. `0xDE6887086F892325FEC04CC0D847525B6931381F` (available in the public keyserver pool).
  14. # In-scope
  15. - Security issues in any current release of Bitwarden. This includes the web vault, browser extension,
  16. and mobile apps (iOS and Android). Product downloads are available at Source
  17. code is available at
  18. # Exclusions
  19. The following bug classes are out-of scope:
  20. - Bugs that are already reported on any of Bitwarden's issue trackers (,
  21. or that we already know of. Note that some of our issue tracking is private.
  22. - Issues in an upstream software dependency (ex: Xamarin, ASP.NET) which are already reported to the
  23. upstream maintainer.
  24. - Attacks requiring physical access to a user's device.
  25. - Self-XSS
  26. - Issues related to software or protocols not under Bitwarden's control
  27. - Vulnerabilities in outdated versions of Bitwarden
  28. - Missing security best practices that do not directly lead to a vulnerability
  29. - Issues that do not have any impact on the general public
  30. While researching, we'd like to ask you to refrain from:
  31. - Denial of service
  32. - Spamming
  33. - Social engineering (including phishing) of Bitwarden staff or contractors
  34. - Any physical attempts against Bitwarden property or data centers
  35. Thank you for helping keep Bitwarden and our users safe!