5 ms·

I think that was the point of the previous comment. That, despite the software being open-source and therefore more likely to have bugs spotted, and despite ha

• austhrow743 6y ago
  If you were selling bogus report results for clients you'd still include a non-major thing or two. Gives a better impression of legitimacy than full marks across the board.
• dsissitka 6y ago
  > ...therefore they must be thorough. I wonder if that's the case here. I don't work in that space but the issues they found seem like they might be low hanging fruit. I've pasted them below for anyone that's curious. > The Cross Origin Resource Sharing (CORS) configuration on Bitwarden server APIs allows for any clientorigin to access its endpoints. > The Content Security Policy (CSP) configuration on the Bitwarden web vault application allows for'unsafe-inline' CSS styles to execute.
  • dspillett 6y ago
    That is why it is important the reports from security audits include what was looked for and at least a little detail about how. If they were appropriately thorough and all they found were low-hanging fruit, then that is a good thing. Of course a detailed report is no absolute guarantee: we once had a test done that I think was more than shoddy: there was not nearly enough activity on the web server over the testing period for the amount of automated work they claimed to have done, and I spotted an issue a couple of weeks later that at least one of their documented processes really should have picked up on. That company is no longer in business thankfully.