Comment by pavon

If you scroll down, it appears that Bitwarden sends BasicAuth passwords in the clear over HTTP. This is a huge security hole, far bigger than the subdomain one.