43 lines
2.2 KiB
Markdown
43 lines
2.2 KiB
Markdown
---
|
|
type: reference
|
|
subtype: api-integration
|
|
title: "Vaultwarden vs Bitwarden Cloud — permission and feature parity gotchas"
|
|
summary: Verified differences between self-hosted Vaultwarden and Bitwarden Cloud that break security designs copied from Bitwarden docs — Edit permission includes delete, no deletion-restriction org policy, no Secrets Manager, trash never auto-purges by default.
|
|
tags:
|
|
- type/reference
|
|
- tool/vaultwarden
|
|
- domain/credential-management
|
|
- domain/security
|
|
scope: global
|
|
date: 2026-07-09
|
|
last_updated: 2026-07-09
|
|
last_reviewed: 2026-07-09
|
|
related:
|
|
- credvault-integration-master-plan
|
|
source: ruby-gems
|
|
---
|
|
|
|
# Vaultwarden Parity Gotchas
|
|
|
|
Bitwarden's official help docs describe Bitwarden Cloud. Vaultwarden reimplements the server
|
|
and does NOT match on these points (verified 2026-07-09, vaultwarden discussions #6131,
|
|
issue #6269):
|
|
|
|
- **Edit collection permission includes deleting items.** There is NO org setting to
|
|
restrict item deletion to Manage-permission members (that toggle is Cloud-only). A "bot
|
|
with Edit but can't delete" design is impossible server-side — enforce in your wrapper/OS layer.
|
|
- **Manage permission is worse for least-privilege** — it grants collection-membership admin.
|
|
- **Secrets Manager does not exist** in Vaultwarden. Don't plan it as a backend.
|
|
- **Trash never auto-purges by default** — permanent deletion only with
|
|
`TRASH_AUTO_DELETE_DAYS` set. (Cloud docs say 30 days.) Safer, but don't cite "30-day window".
|
|
- **Password history ("last 5")** is written client-side into the cipher; compatible clients
|
|
preserve it, raw API writes can clobber it. Likely works — verify per instance.
|
|
- **`bw` CLI API-key login still requires `bw unlock` + master password** for vault data;
|
|
the API key does not replace the master password. Non-interactive automation needs a
|
|
protected `--passwordfile`.
|
|
- **`bw list items --search` doesn't match custom fields** — filter client-side on parsed JSON.
|
|
- Maintainer (BlackDex) states Vaultwarden "does not support the full range of RBAC/GBAC/CBAC".
|
|
|
|
Rule of thumb: any "Bitwarden supports X" claim from bitwarden.com/help must be re-verified
|
|
against the deployed Vaultwarden version before it becomes a security assumption.
|