Self-Hosting Vaultwarden Without Trusting the Defaults

Vaultwarden gives you a Bitwarden-compatible password server in one container and about ten minutes. The defaults that make that possible leave org creation open, audit logging off, accounts on PBKDF2, and a rate limiter that trusts a header anyone can set.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.