You can try logging in manually from the CLI to check whether it works:
cd ~/.local/share/harbour-bitsailor/harbour-bitsailor/./bin/bw config server https://bitwarden.euBW_CLIENTID=<your-client-id> BW_CLIENTSECRET=<your-client-secret> ./bin/bw login --apikeyReplace <your-client-id> and <your-client-secret> with the actual values. If any error pops up, that’s what’s preventing the login.
According to this the correct url might be https://vault.bitwarden.eu
…….. Stupid me …. Thank you, you kind sir 
Have a great weekend!
Hello, I have a question that may be stupid. Do you know rbw? A Bitwarden client written in Rust. Packaging Bitsailor with this binary might be a good idea. Could this simplify its distribution in the Jolla Store?
Hey there, I didn’t know about it. I’ll take a look at it when I have the time, at the first glance it solves a “problem” of the official BW cli being stateless, which is actually a really good thing when you’re trying to wrap a GUI around a CLI client. I believe it could be worked around, though, but it’s extra work.
I’ll have to take a look at the source code and documentation to see whether it could be worked with. Though I must admit that it being a native binary is tempting because node.js is just so slow on SFOS.
5 posts were split to a new topic: Compile rbw on Sailfish OS
Hi! I was wondering if there was plan to provide offline support? And sorry if the question was already answered in this thread, but couldn’t find it 
Hi and thanks from the GREAT app!
Edit. deleted the rest. When I manually synced the Bitsailor it updated!
Hmm, up until now I thought it would work, but tbh I never really cared.
I’ll try implementing it when I have the time.
Really, I don’t want to cause any unnecessary alarm, but I think this is worth sharing: Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain ... . Investigation is still ongoing.
Uff, got me scared for a while. No passwords were compromised as part of this, the attack was targeting stealing credentials from your env, not your Bitwarden passwords.
Mostly dangerous on developer machines, but if you have some secret tokens stored in your env or something and had the infected version installed, you should rotate all secrets available on your phone in plaintext.
The update was live between 21:57 and 23:30 PM UTC on April 22, 2026, so unless you updated your BW CLI at that time, you’re fine.
There would appear to be a critical security flaw with BitSailor that can leak your master password, username, and tokens to any unjailed app running on your phone.
This was discovered recently due to a post BitSailor’s dev made on my plex app thread here but I fear BitSailor’s users won’t see that so I’m commenting here.
I made a repo that demonstrates the problem with a proof-of-concept app and remediation suggestions on github: https://github.com/sailfishdisclosure/BitSailorVulnerability
There also appears to be one oversight with files in the “patch” folder that has the potential to lead to another major vulnerability in the future.
If BitSailor’s developer wants to reach out to me privately I can disclose the vulnerability and give him advice on how to patch these issues.
Sure, I appreciate it! Please PM with details.
Is there any news on this? I kinda dont want to install an app with such a big security flaw, but i also dont want to install a closed source maybe AI app that can have a billion unknown big security bugs…
Or is the only way right now to use the web version of my vaultwarden? Or Android app?
I dont stand on any side of your debate, but I find it weird that one side ignores concerns and always has to tell others about their sucessfull job and the other side is just silent about everything and dont update anybody on the security flaw on hand… Im sorry if i worded that aggressive against any side - i didnt want that. Im just a confused new jolla phone user. 
The issue has been fixed, though a very BitSailor targetted thing can still do that, though it’s harder now.
Had to analyse it myself because I never heard back privately as was promised to me.
I plan on a full rewrite but it will take a while cause I’m swamped with work right now. I personally use it just fine, the general rule applies: Don’t install untrusted stuff and nothing bad happens (the vulnerability only works locally, nothing can hack you remotely, it has to be software actively installed by you).
If someone is willing to sponsor it financially, get in contact with me and I can give it a higher priority but right now all of my free and open source work is moving slowly.
Anyway, tldr: the original security flaw is fixed but the general approach used for it is still there and needs major rewrite to get rid of. I personally use the app just fine every day.
I asked the developer to reach out to me privately, he never did. He just replied to a comment telling me to message HIM, that’s not what I asked him to do. Where I come from, when people do you favors, you don’t make them come to you.
He did patch the most egregious bug that leaked your master password using the AI he hates so much but it is still VERY vulnerable. All your secrets are still accessible with one small tweak to my existing app.
Your one saving grace is that the Sailfish community is quite small, and I doubt there are many bad actors (if any) floating around here.
On open source, I want you to keep in mind that this was open source for what, 4 years? and no one noticed in all that time it was committing one of the worst possible security faux pas you can possibly make in the industry - for disclosure: he was sending your master password in plain text on the command line so any unjailed app could pick that right up from /proc.
I think even non-developers will know that you should never, ever, ever do that.
Dude, stop spamming me, seriously. You’re very tiring, obnoxious and no one’s gonna like your AI’s apps just because you spam me constantly. You’re going to my ignore list, anyway.
Code develops over time and many eyes can still miss flaws. Using an AI to find bugs is way easier, because it can check against all kinds of vectors at once.
I respect all the work you did and Im glad you made everyone aware that there was this issue. Thank you.
I just want this to be a friendly welcoming place and for that part I would be very happy if we could forget the childish who has to PM who first or whatever and be more helpful to each other. Maye Im doing you wrong by adressing you and thats my fault, but I want to make a general statement for constructive, helpful and friendly discussions. <3
So thank you for both of you (and anybody else) to contribute to Sailfish OS and making it a bit better for everyone
Just a FYI to keep you all posted: Started working on a new core which I’ll use to entirely replace the dependency on the official bitwarden cli. If anyone is interested, you can find it here but beware it’s unfinished and undocumented.
Pros:
Cons:
I’ve managed to implement everything except for updating an existing item into the core. Once I finish that, the work on implementing the core into BitSailor will start.
