Wait, they don’t affect security? Wouldn’t a hash collision mean pulling that hash from GitHub would pull wrong code? Or maybe delete code? I’d assume the hash is used as a lookup key in a database somewhere.

You also pin dependencies to specific hashes for security reasons.

We really need a VaultWarden paid service, if there isn’t anything against doing so in the license.

I don’t know why the server needs any specialized software at all though. In the end, if it’s just some password history, why not just have a client that allows generic storage backends and you can upload to Filen or S3 or whatever else you use?