Please report vulnerabilities privately. Do not open a public issue, pull request or discussion for a suspected vulnerability.

• While this repository is private, contact the maintainer, Christopher Hickman (@chriswayneh), privately on GitHub. GitHub private vulnerability reporting will be turned on when the repository goes public; until then it is not available here.
• Include the bbwarden version (bbwarden --version), the command you ran, what you expected and what happened. Redact tokens, passwords and internal hostnames.
• If you think a credential was exposed, rotate it first. Deleting output or commits is not enough.

You will get an acknowledgement as soon as practical. Fixes are released as a new patch version, and the CHANGELOG Security section describes them.

• https only (since 0.2.1). BBWARDEN_URL and CROWD_URL must use https://. Plain http:// is refused for every host, loopback included, unless you pass --insecure, which allows it and prints a warning on stderr. Use it only for a local test server. A URL that is not a valid URL or has no hostname (for example https:// or https:x) is always refused. So is a URL with embedded credentials (https://user:pass@host), a query string or a fragment; the error does not repeat the URL. A failed --apply step reports only the exception type for unexpected errors, never their message.
• No redirects (since 0.2.1). Every request is sent with redirects disabled, and the sessions allow zero redirects. A 3xx response, whether requests or bbwarden sees it, is an error (redirect refused: <status> to <host>) that names only the status and the target host, so credentials are never replayed to another origin or over http.
• Exact Cloud detection. Credentials go to Bitbucket Cloud only when the hostname is exactly bitbucket.org or api.bitbucket.org. Pagination links must match the base URL scheme, host and port, so credentials never follow a link to another origin.
• No secrets in output. Credentials come only from environment variables, never from command-line arguments or the URL. URLs in messages are reduced to scheme, host, port and path (userinfo, query and fragment dropped). Error messages name missing variables but never print their values, and they leave out response bodies.
• Dry run by default. regroup and offboard only print a plan unless you pass --apply. regroup never picks a group whose grant would widen anyone's access. On failure, --apply reports exactly which steps finished, failed and were not run, also on Ctrl-C (exit 130).
• No silent partial results (since 0.2.4). Malformed or cyclic pagination stops the run (exit 1) instead of using a partial list. When part of the inventory cannot be loaded (for example global admins without system admin rights), bbwarden prints NOTE: and INCOMPLETE: on stderr and exits 3, so an offboard that could not see every access never looks complete. offboard removes every direct global permission, and regroup --apply re-reads group members before each grant. Exit codes are listed in the README.
• Safe exports. CSV output neutralizes spreadsheet formulas, also behind leading invisible characters, and escapes control and format characters like terminal output (since 0.2.2). --raw-csv keeps them, with a warning; formulas are still neutralized and lone surrogates become U+FFFD. CSV files are written atomically and an existing file is never removed or truncated by the writability check (since 0.2.4). Note: the target path is resolved once; an attacker who can write to a folder on that path can redirect the write between resolve and rename. Write reports to folders only you control.
• No raw tracebacks (since 0.2.2). An unexpected error prints a traceback with exception types only (no messages, notes or arguments that could carry secrets) and exits 1; log tracebacks are rendered the same way. Ctrl-C prints interrupted and exits 130, also while bbwarden is still importing or parsing arguments (since 0.2.4); a non-UTF-8 --idp-file is a configuration error (exit 2).
• Escaped terminal output (since 0.2.2). Table cells and stderr lines print control and format characters (C0, DEL, C1, Unicode Cc, Cf, Cs, Co, Cn, Zl, Zp) as escaped code points, never raw; backslashes are doubled and log messages are escaped with their arguments.
• Least privilege. Read commands need admin read only. Parts that need more rights (global admins, workspace owners) are skipped with a NOTE: instead of failing.