Pangolin bypass rules raise a practical security question

A Pangolin setup that protects Vaultwarden may still need some paths to skip extra login checks. The Vaultwarden app can require paths such as /api to stay reachable so it can talk to the server. That creates a clear concern: a bypass rule may become a weak spot because it lets traffic avoid Pangolin’s added authentication.

In this setup, Pangolin and Vaultwarden are running on the same VPS. The core issue is how to keep app access working without turning bypassed paths into an easy attack route.