Bitwarden Security Context
- 64 installs
- 129 repo stars
- Updated August 4, 2026
- bitwarden/ai-plugins
Bitwarden Security Context is a Claude skill providing a quick reference to Bitwarden's security principles P01-P06, security vocabulary, and data classification standards.
About
This skill is a quick-reference for Bitwarden's foundational security framework: the six security principles P01-P06, standard security vocabulary, and data classification standards. It defines guarantees like zero-knowledge servers, locked-vault security, and minimized breach impact, plus terms like protected data and trust boundaries. A developer uses it to get security context for development, code review, or security analysis without loading the full threat-modeling skills.
- Six security principles P01-P06 with core guarantees
- Standard security vocabulary and data classification standards
- Zero-knowledge, locked-vault, and breach-minimization guarantees
Bitwarden Security Context by the numbers
- 64 all-time installs (skills.sh)
- Ranked #1,216 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
bitwarden-security-context capabilities & compatibility
- Capabilities
- security audit · security context
- Use cases
- security audit
What bitwarden-security-context says it does
These six principles form the foundation for all security decisions at Bitwarden.
Bitwarden infrastructure cannot access unencrypted user data.
npx skills add https://github.com/bitwarden/ai-plugins --skill bitwarden-security-contextAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 64 |
|---|---|
| repo stars | ★ 129 |
| Last updated | August 4, 2026 |
| Repository | bitwarden/ai-plugins ↗ |
What it does
Get Bitwarden's foundational security principles, vocabulary, and data classification for any security task.
Who is it for?
Getting foundational Bitwarden security context (principles, vocabulary, data classes) during development or review.
Skip if: Running a full threat model or architecture review, which have dedicated skills.
When should I use this skill?
You need foundational security context such as trust boundaries, data protection requirements, or Bitwarden security terminology.
What you get
Development and review decisions are grounded in Bitwarden's six security principles and standard data-classification vocabulary.
- Security principles and vocabulary reference for a task
By the numbers
- Six security principles P01-P06
Files
Bitwarden Security Context
Quick-reference for Bitwarden's foundational security framework. Use this for security context during development, code review, or security analysis without loading the full threat-modeling or architecture-review skills.
Security Principles (P01-P06)
These six principles form the foundation for all security decisions at Bitwarden.
| Principle | Name | Core Guarantee |
|---|---|---|
| P01 | Servers are Zero Knowledge | Bitwarden infrastructure cannot access unencrypted user data. The server must not enable weakening of user-chosen protections, masquerade server data as user-encrypted content, or access encrypted data outside the client context. |
| P02 | A Locked Vault is Secure | Highly sensitive vault data cannot be accessed in plaintext once the vault is locked, even if the device is compromised after locking. Platform limitations (e.g., JS memory) are mitigated through buffer clearing and available security features. |
| P03 | Limited Security on Semi-Compromised Devices | For unlocked vaults on devices with userspace malware (but intact OS/kernel), clients maximize kernel/OS-level protections and balance security with usability through controls like biometrics. |
| P04 | No Security on Fully Compromised Systems | Bitwarden cannot guarantee vault protection when hardware or OS-level integrity is fully compromised. This applies to unlocked vaults only — locked vaults are covered by P02. |
| P05 | Controlled Access to Vault Data | Vault data, whether at rest or in use, is accessible only to authorized parties under the user's explicit control. Isolation mechanisms are critical in high-risk environments like web browsers. |
| P06 | Minimized Impact of Security Breaches | Limit breach scope and duration through session invalidation, key rotation (countering "harvest now, decrypt later"), and post-compromise security (new data remains protected after a breach). |
Controlled Exceptions
Principles have documented exceptions. Known examples:
- P01 — Key Connector: Self-hosted SSO without passwords. The server holds encryption keys on behalf of the user.
- P01 — Icons Service: Plaintext domain names are sent to retrieve favicons.
Full documentation: Security Principles
Security Vocabulary
Standard terminology for security discussions at Bitwarden.
| Term | Definition |
|---|---|
| Vault Data | A user's private information stored in Bitwarden (passwords, usernames, secure notes, credit cards, identities, attachments) |
| Protected Data | Data stored in unreadable format (typically encrypted) with expectations about secure key storage |
| Data at Rest | Stored data not actively used or transmitted (disk storage on devices or servers) |
| Data in Use | Data actively being processed or accessed, held in volatile memory |
| Data in Transit | Data actively transferred between locations, processes, or devices |
| Secure Channel | A communication channel providing confidentiality (unreadable to unauthorized parties) and integrity (tamper-proof) |
| Trusted Channel | A secure channel that also provides authenticity (verified identities of communicating parties) |
| Data Exporting | Controlled process where data leaves Bitwarden unprotected, nullifying security guarantees. Requires informed consent. |
| Data Sharing | Controlled data exchange within the Bitwarden secure environment (security guarantees maintained) |
| Data Leaking | Unintentional departure of data from Bitwarden unprotected |
| Bitwarden Secure Environment | Any process or application adhering to Bitwarden's security standards |
Full documentation: Security Definitions
Security Requirements by Category
| Category | Scope | Key Obligations |
|---|---|---|
| VD | Vault Data | Protected at rest (encrypted with UserKey), allowed in use (decrypted during unlock), trusted channels in transit, export requires informed consent |
| EK | Encryption Keys | 256-bit security strength, protected at rest and in transit, must never be exported |
| AT | Authentication Tokens | Protected storage at rest, mandatory transit protection |
| SC | Secure Channels | Confidentiality, integrity, replay prevention, forward secrecy for long-lived channels |
| TC | Trusted Channels | Secure channel properties plus receiver identity verification |
Full documentation: Security Requirements
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What does P01 guarantee?
Servers are zero knowledge: Bitwarden infrastructure cannot access unencrypted user data.
What is Protected Data?
Data stored in an unreadable format, typically encrypted, with expectations about secure key storage.