Email verification required after logging in to Web Vault?

[grb]

Is it one of these comments that you are referring to?

Login with Passkey, "Use for vault encryption"

How are you logged in to the Web Vault? If you logged in with a passkey or logged in with a device, then Bitwarden is not able to use the master password for verification, and in such cases it will fall back to an email code.

Exporting vault is too easy

Yes, the email verification code is required only when a user has logged in without a master password. To me, what would make most sense is a requirement to re-authenticate (using master password, device, passkey, etc.). But with the current system, is is the user’s responsibility to ensure that the vault is locked when not in use, to prevent access by unauthorized individuals.

 

I recall that this explanation was originally provided by a Bitwarden rep, but I have been unable to find the original source.