VaultType handles master passwords and vault data, so security reports are taken seriously.

Please do not open a public issue for security problems. Report them privately through GitHub's private vulnerability reporting.

Include as much detail as you can - affected version, steps to reproduce, and impact. Please do not include your own master password or vault contents.

VaultType is a native Bitwarden client: it speaks the Bitwarden server API directly and performs all cryptography in-process (see the security model). Reports about the Bitwarden / Vaultwarden server itself belong to those projects. In scope here is everything VaultType does itself: the protocol client and its cryptography (KDF, vault decryption, TOTP, SSH signing, passkeys), memory handling (locked buffers, encryption at rest in RAM), auto-typing and the field lookup it uses to place values, the clipboard, process launching, and screen-capture protection.

Only the latest release is supported. Please reproduce on the newest version before reporting.