Does Bitwarden have a bug bounty program?

Bitwarden runs a public vulnerability disclosure program (VDP) on HackerOne. It accepts good-faith security reports but does not offer cash rewards. It lists 22 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/bitwarden

Bitwarden

HackerOne·updated 7h ago

vdpopen

Discord → RSS

payout: no bounty
scope: 22 in · 8 out
safe harbor: unknown
response: no reports

open program

signalsscope ×1.2 in 90dderived from our snapshot history

hunt score

vdpfresh

formula →

payout

0/55

bounty

0/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

22 in-scope

8other
7urls
6source
1ios

Scope

In scope

022

urls07

ios01

+com.8bit.bitwarden· critical

source code06

+github.com/bitwarden/android· critical
+github.com/bitwarden/clients· critical
+github.com/bitwarden/ios· critical
+github.com/bitwarden/sdk-internal· critical
+github.com/bitwarden/server· critical
+github.com/bitwarden· critical

other08

+9pjsdv0vpk04· critical
+com.bitwarden.authenticator· critical
+com.x8bit.bitwarden· critical
+addons.mozilla.org/en-US/firefox/a…n/bitwarden-password-manager/· critical
+addons.opera.com/extensions/detail…warden-free-password-manager/· critical
+chrome.google.com/webstore/detail/…pebfimnlniiiahkandclblb?hl=en· critical
+safari-extensions.apple.com/detail…m.bitwarden.safari-LTZ2PFU5D6· critical
+www.npmjs.com/package/@bitwarden/mcp-server· critical

Out of scope

008

−github.com/bitwarden/.githubsource_code
−github.com/bitwarden/agent-accesssource_code
−github.com/bitwarden/akd-watchsource_code
−github.com/bitwarden/autopush-managersource_code
−github.com/bitwarden/bitwarden-russhsource_code
−github.com/bitwarden/phishing-test-pagesource_code
−github.com/bitwarden/rotation-daemonsource_code
−github.com/bitwarden/passwordless-react-examplesource_code

Change history

2 events

in-scope over 70dpeak 22

first indexedscope addedscope removedreward change

2026-10-15
+ added 5 scopes
22d ago
2026-08-06
first indexed
92d ago · 18 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Bitwarden.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/bitwarden",
  "name": "Bitwarden",
  "handle": "bitwarden",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WINDOWS_APP_STORE_APP_ID",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "9pjsdv0vpk04",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "api.bitwarden.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "bitwarden.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "com.8bit.bitwarden",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "com.bitwarden.authenticator",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "com.x8bit.bitwarden",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "docs.passwordless.dev",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "help.bitwarden.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://addons.opera.com/extensions/details/bitwarden-free-password-manager/",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://chrome.google.com/webstore/detail/bitwarden-free-password-m/nngceckbapebfimnlniiiahkandclblb?hl=en",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Archived repos are out of scope.",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/bitwarden",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/bitwarden/android",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/bitwarden/clients",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/bitwarden/ios",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/bitwarden/sdk-internal",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/bitwarden/server",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://safari-extensions.apple.com/details/?id=com.bitwarden.safari-LTZ2PFU5D6",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://www.npmjs.com/package/@bitwarden/mcp-server",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "identity.bitwarden.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "v4.passwordless.dev",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "vault.bitwarden.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/.github",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/agent-access",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/akd-watch",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/autopush-manager",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/bitwarden-russh",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/passwordless-react-example",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": false,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/phishing-test-page",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://github.com/bitwarden/rotation-daemon",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://bitwarden.com/",
  "offers_swag": false,
  "managed_program": false,
  "offers_bounties": false,
  "submission_state": "open",
  "allows_bounty_splitting": false,
  "average_time_to_bounty_awarded": null,
  "response_efficiency_percentage": 100,
  "average_time_to_report_resolved": null,
  "average_time_to_first_program_response": 19
}