Security

A password manager has to earn trust. Here's how PassBundle is built, and how to tell us if you find a problem.

How your vault is protected

• End-to-end encryption. Items are encrypted with AES-256 on your device before they're stored or synced. The key comes from your master password, which never leaves your device.
• The server can't decrypt. It stores encrypted data and never holds a key that can open a vault. Organization keys are shared between members' devices, encrypted to each member.
• Proven code. PassBundle is built on the open-source Bitwarden clients and Vaultwarden, and follows their releases and security fixes. Changes to encryption or sign-in code need a written design and tests.
• Open source. Everything is public on GitHub, so anyone can check it.

Reporting a vulnerability

Please report security issues privately, never in a public issue:

• On GitHub: open the repository's Security tab and choose Report a vulnerability, in the apps or the server.
• By email: security@passbundle.com.

Tell us what you found, how to reproduce it, and what an attacker could do with it. We'll reply as soon as we can and keep you updated until it's fixed.

While you research

• Give us reasonable time to fix an issue before you disclose it.
• Only test against accounts and servers you own, or have explicit permission to test.
• Don't access, change, or delete other people's data, and don't degrade the service for others.

We won't pursue legal action against research done in good faith under these rules.