I am not. Working well so far. My instance is behind Caddy, behind a secret URL path. To talk to the instance, this “pre-shares secret” needs to be known first. So far I haven’t seen any abnormal hits. I’m closing in on 3 years of using it in this setup, via Vaultwarden.

I’m aware that this is security through obscurity. The instance’s accounts use strong passwords and MFA.

I thought so too. But then did a quick search on Shodan and found these:

https://www.shodan.io/search?query=bitwarden

https://www.shodan.io/search?query=vaultwarden

I'm afraid not. I've seen some really dumb setups of BW when helping selfhosted.

I do think that while selfhosting is admirable, in the case of your password vault, it's not. It's one thing where I'd always advice against selfhosting or DIY, because the downside risk is just too big.

The chance of fng up may be tiny, bit if you fck up, it's bad. Potentially bankruptcy or jail bad.