Let’s say I have an unupdated patch and my server is now vulnerable.

This could really happen. I have work and life to worry about and I might not notice.

This vulnerability, could be in the BW instance itself (say the web server or the backend itself), or in the server itself (say an old OpenSSH version), or another service (NextCloud instance hosted in the same server under a different subdomain).

So, first we see it’s a big attack surface. In any of those entrances an attacker could gain access to my server and with it the vault. It’s a short way from there to install a keylogger on the website where BW is hosted, and get my master password ¯_(ツ)_/¯.

Now take into consideration that I just sat a couple of minutes to think about this, and I’m not a professional in cyber security or web security. Neither blue nor red team. A professional, with more knowledge, time, experience and resources, could probably bring up much more things.

Bitwarden.

My recommendation: Don’t use Vaultwarden (self hostable server side of bitwarden. Really easy to run and use). Why? You’re not a security personal, and securing your vault isn’t your job. You might do a slight mistake that’ll lead to the compromise of your vault.

The people at Bitwarden have their work dedicated to securing the vaults and all they do is security. And they’ll probably do it better then you. When it comes to serious matter, I prefer to trust the professionals.

If I were in your position, I wouldn’t have installed it. VT got 37 vendors to flag it.

And it’s very common for cracked programs to contain some malware, so my trust wasn’t high to begin with. I’m always skeptical about this kind of thing.