Define threat model

SECURITY.md

@@ -1,49 +1,38 @@
-Vaultwarden tries to prevent security issues but there could always slip something through.
-If you believe you've found a security issue in our application, we encourage you to
-notify us. We welcome working with you to resolve the issue promptly. Thanks in advance!
+Vaultwarden tries to prevent security issues, but something could always slip through. If you believe you've found a security issue in our application, we encourage you to notify us. We welcome working with you to resolve the issue promptly. Thanks in advance!
 
-# Disclosure Policy
+# Scope
 
-- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every
-  effort to quickly resolve the issue.
-- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a
-  third-party. We may publicly disclose the issue before resolving it, if appropriate.
-- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or
-  degradation of our service. Only interact with accounts you own or with explicit permission of the
-  account holder.
+Security issues in the current release of Vaultwarden and in the `main` branch (the `testing` image) are in scope. Our [threat model](THREAT_MODEL.md) describes who is trusted with what, what is out of scope, and how we rate severity. Please read it before reporting.
 
-# In-scope
+# How to report a security issue
 
-- Security issues in any current release of Vaultwarden. Source code is available at https://github.com/dani-garcia/vaultwarden. This includes the current `latest` release and `main / testing` release.
+- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
+- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third party. We may publicly disclose the issue before resolving it, if appropriate.
+- Credit goes on the advisory and needs a GitHub account or email address. Reports of an issue whose fix is already public, from the moment its pull request is opened, are normally not credited.
+- Vaultwarden is an open source project and does not offer rewards.
 
-# Exclusions
-
-The following bug classes are out-of scope:
-
-- Bugs that are already reported on Vaultwarden's issue tracker (https://github.com/dani-garcia/vaultwarden/issues)
-- Bugs that are not part of Vaultwarden, like on the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
-- Issues in an upstream software dependency (ex: Rust, or External Libraries) which are already reported to the upstream maintainer
-- Attacks requiring physical access to a user's device
-- Issues related to software or protocols not under Vaultwarden's control
-- Vulnerabilities in outdated versions of Vaultwarden
-- Missing security best practices that do not directly lead to a vulnerability (You may still report them as a normal issue)
-- Issues that do not have any impact on the general public
+Vaultwarden has no hosted service. Test only on instances you run yourself, and make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of other people's servers. Only interact with accounts you own or with the explicit permission of the account holder.
 
 While researching, we'd like to ask you to refrain from:
 
-- Denial of service
-- Spamming
-- Social engineering (including phishing) of Vaultwarden developers, contributors or users
+- Denial of service against servers you do not run. You can still report availability issues you reproduce on your own instance.
+- Spamming.
+- Social engineering (including phishing) of Vaultwarden developers, contributors or users.
 
-Thank you for helping keep Vaultwarden and our users safe!
+A good report covers one root cause and states the version or commit you tested, the lowest privileges needed, what the attacker gains, any non-default settings, the steps to reproduce it, and whether you ran them or only read the code.
+
+If you use AI tools, you remain responsible for what you send. Reproduce the issue on your own instance before reporting it, check its scope and severity against our threat model rather than the tool's assessment, and include the requests, responses or logs that show it.
 
 # How to contact us
 
-- You can contact us on Matrix https://matrix.to/#/#vaultwarden:matrix.org (users: `@danig:matrix.org` and/or `@blackdex:matrix.org`)
+- You can open a [private vulnerability report](https://github.com/dani-garcia/vaultwarden/security/advisories/new) on GitHub.
 - You can send an ![security-contact](/.github/security-contact.gif) to report a security issue.<br>
-  If you want to send an encrypted email you can use the following GPG key: 13BB3A34C9E380258CE43D595CB150B31F6426BC<br>
+  If you want to send an encrypted email, you can use the following GPG key: `13BB3A34C9E380258CE43D595CB150B31F6426BC`<br>
   It can be found on several public GPG key servers.<br>
-    * https://keys.openpgp.org/search?q=security%40vaultwarden.org
-    * https://keys.mailvelope.com/pks/lookup?op=get&search=security%40vaultwarden.org
-    * https://pgpkeys.eu/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
-    * https://keyserver.ubuntu.com/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
+    - https://keys.openpgp.org/search?q=security%40vaultwarden.org
+    - https://keys.mailvelope.com/pks/lookup?op=get&search=security%40vaultwarden.org
+    - https://pgpkeys.eu/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
+    - https://keyserver.ubuntu.com/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
+- You can contact us on Matrix for questions, without vulnerability details: https://matrix.to/#/#vaultwarden:matrix.org (users: `@danig:matrix.org` and/or `@blackdex:matrix.org`).
+
+Thank you for helping keep Vaultwarden and our users safe!