You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
50 lines
2.9 KiB
50 lines
2.9 KiB
Vaultwarden tries to prevent security issues but there could always slip something through.
|
|
If you believe you've found a security issue in our application, we encourage you to
|
|
notify us. We welcome working with you to resolve the issue promptly. Thanks in advance!
|
|
|
|
# Disclosure Policy
|
|
|
|
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every
|
|
effort to quickly resolve the issue.
|
|
- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a
|
|
third-party. We may publicly disclose the issue before resolving it, if appropriate.
|
|
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or
|
|
degradation of our service. Only interact with accounts you own or with explicit permission of the
|
|
account holder.
|
|
|
|
# In-scope
|
|
|
|
- Security issues in any current release of Vaultwarden. Source code is available at https://github.com/dani-garcia/vaultwarden. This includes the current `latest` release and `main / testing` release.
|
|
|
|
# Exclusions
|
|
|
|
The following bug classes are out-of scope:
|
|
|
|
- Bugs that are already reported on Vaultwarden's issue tracker (https://github.com/dani-garcia/vaultwarden/issues)
|
|
- Bugs that are not part of Vaultwarden, like on the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
|
|
- Issues in an upstream software dependency (ex: Rust, or External Libraries) which are already reported to the upstream maintainer
|
|
- Attacks requiring physical access to a user's device
|
|
- Issues related to software or protocols not under Vaultwarden's control
|
|
- Vulnerabilities in outdated versions of Vaultwarden
|
|
- Missing security best practices that do not directly lead to a vulnerability (You may still report them as a normal issue)
|
|
- Issues that do not have any impact on the general public
|
|
|
|
While researching, we'd like to ask you to refrain from:
|
|
|
|
- Denial of service
|
|
- Spamming
|
|
- Social engineering (including phishing) of Vaultwarden developers, contributors or users
|
|
|
|
Thank you for helping keep Vaultwarden and our users safe!
|
|
|
|
# How to contact us
|
|
|
|
- You can contact us on Matrix https://matrix.to/#/#vaultwarden:matrix.org (users: `@danig:matrix.org` and/or `@blackdex:matrix.org`)
|
|
- You can send an  to report a security issue.<br>
|
|
If you want to send an encrypted email you can use the following GPG key: 13BB3A34C9E380258CE43D595CB150B31F6426BC<br>
|
|
It can be found on several public GPG key servers.<br>
|
|
* https://keys.openpgp.org/search?q=security%40vaultwarden.org
|
|
* https://keys.mailvelope.com/pks/lookup?op=get&search=security%40vaultwarden.org
|
|
* https://pgpkeys.eu/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
|
|
* https://keyserver.ubuntu.com/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
|