That’s a good point.
Notice, your server is less likely to be targeted. But much more likely to receive a breach once it’s targeted.
It’s helpful to analog. You got gold. Thieves are more likely to target a bank, but if they’ll know of some gold in your house, it’ll be much easier for them to take it from your house rather than from the bank.
And now you have to work and make sure people don’t find out about the gold in your house. Because once they did it’s game over.
Bitwarden.
My recommendation: Don’t use Vaultwarden (self hostable server side of bitwarden. Really easy to run and use). Why? You’re not a security personal, and securing your vault isn’t your job. You might do a slight mistake that’ll lead to the compromise of your vault.
The people at Bitwarden have their work dedicated to securing the vaults and all they do is security. And they’ll probably do it better then you. When it comes to serious matter, I prefer to trust the professionals.
I’m happy with SearXNG. At the time I had issues with each search engine, and this meta search engine is great for me.
You can run one locally on your device, or connect it to a domain like I did, so I use it everywhere: seek[.]agurav[.]xyz You’re welcome to try mine, or use it daily. it’ll blend my own activity a bit so it’s good for me. For u, you’ll have to trust my word that I don’t sell your data or something. ¯_(ツ)_/¯
Ultimately, give it a try, and then host your own or use a public instance that you trust.
Let’s say I have an unupdated patch and my server is now vulnerable.
This could really happen. I have work and life to worry about and I might not notice.
This vulnerability, could be in the BW instance itself (say the web server or the backend itself), or in the server itself (say an old OpenSSH version), or another service (NextCloud instance hosted in the same server under a different subdomain).
So, first we see it’s a big attack surface. In any of those entrances an attacker could gain access to my server and with it the vault. It’s a short way from there to install a keylogger on the website where BW is hosted, and get my master password ¯_(ツ)_/¯.
Now take into consideration that I just sat a couple of minutes to think about this, and I’m not a professional in cyber security or web security. Neither blue nor red team. A professional, with more knowledge, time, experience and resources, could probably bring up much more things.