Is the Passbolt password manager secure against root access, e.g. if I install Passbolt onto a VPS can it be considered secure or could the VPS host access the passwords stored within it?
Full disclosure: I'm one of passbolt developer.
That being said, it is possible for the attacker to breach the following: - Confidentiality: the attacker can create/edit a user to trick another user into sharing the password with attacker. This could mitigated in the future using key signatures (for example the admin signing all the users keys). - Availability: root access means obviously that all passwords can be deleted / tampered with. - Integrity: idem.