Security and privacy

What Libreyard cannot see

The contents of your vault, and your master password. The Bitwarden clients encrypt the vault on your device, and the server only ever stores ciphertext. It also means Libreyard cannot reset a master password you have forgotten.

What Libreyard can see

The email address of each account on your instance, how many items each vault holds and how large they are, when each device connects, and from which IP address. Any Vaultwarden server sees the same, including one you run yourself.

It can also see which websites your vaults hold logins for. The apps ask the server for each site's icon by the site's address, and the server fetches the icon from that site and keeps a copy named after it. To avoid this, turn off "Show website icons" in each app's settings.

What the host could do

Whoever runs the host, or breaks into it, could copy the encrypted database, open your admin page, stop or delete the instance, or serve a tampered web vault. Libreyard keeps a copy of your admin token so the portal can show it to you; the admin page manages users and settings but cannot show vault contents. A copied database is only as safe as the master passwords protecting it, so choose long ones.

The web vault

The web vault at https://NAME.libreyard.app is JavaScript sent by the server, and it handles your master password. A compromised host could send code that leaks it. This is true of every web vault, hosted or self-hosted. The apps and browser extensions ship their own code and are not affected, so use them day to day and keep the web vault for tasks that need it, such as managing an organisation.

The portal

• Logging in takes a password and a code from an authenticator app. Passkeys are planned.
• Downloading data, showing the admin token, resetting the configuration, uninstalling, deleting, and changing your password or email address ask for the password and a code again.
• You get an email when a download is prepared, when your password or email address changes, and when a recovery code is used.
• The portal account is separate from your vault account. Members of your instance have no portal account.
• Passwords are stored as scrypt hashes, logins are rate limited, and pages are served with a strict Content-Security-Policy.

Payments

Card payments go through Stripe. Libreyard never sees the card number; it stores a Stripe customer reference and the state of each subscription.

Other customers

Each instance runs in its own sandbox. The measures and their limits are on how it works.

This site

Static HTML and one stylesheet, with no cookies, analytics or requests to other domains. The portal sets only the cookies that logging in needs.

Legal requests

Libreyard can be compelled to hand over what it holds: the information listed above, and ciphertext.

Default settings

• New accounts on your instance need an invitation. Open sign-up is off unless you turn it on in the admin page.
• The web vault's sign-up form ticks "Check known data breaches" by default, which makes your browser contact an outside service. Untick it if you prefer.

Reporting a problem

Write to support@baythreesoftware.ca with "security" in the subject.