I’m not an expert with web sockets or web development - but re: Get Params, Vaultwarden has to follow the API of the upstream Bitwarden implementation:

https://github.com/dani-garcia/vaultwarden/discussions/1549#...

The upstream also had this issue, which appeared to be closed without a PR:

https://github.com/bitwarden/server/issues/3650

Requiring a reverse proxy for TLS is pretty standard, but the rest of those findings are egregious (if they haven't been addressed yet.)

Those problems are endemic to all web apps.

e.g. You can’t just provide software to people that obtains TLS certs on their behalf: you have no idea how their infra is setup.

Hosting any app on your own infra is a serious skill set.

Since it's authored by the vaultwarden collaborators, I would not trust the project any bit of my passwords.