By the numbers

Data collected on 2026-04-30 from the main branch at commit 27ae3d54.

Size

xychart-beta horizontal
    title "Source lines of code by language"
    x-axis ["C#", "T-SQL", "JSON", "cshtml/Razor", "YAML", "JavaScript"]
    y-axis "Lines" 0 --> 1100000
    bar [1092487, 80662, 22485, 3853, 2725, 1348]

• C# under src/ and bitwarden_license/src/ — ~118,050 lines across the deployable services and Core/Infrastructure libraries; ~69,950 of those are inside src/Core alone.
• T-SQL in src/Sql/ — 619 .sql files (tables, views, functions, stored procedures) totalling ~80k lines. Plus 473 SQL change scripts in util/Migrator/DbScripts/. ~1,113 .sql files repo-wide.
• C# tests — 908 .cs files under test/ and bitwarden_license/test/.
• Solution — 56 .csproj files referenced from bitwarden-server.sln. 11 of those are deployable services; the rest are libraries, test projects, and dev tooling.

File-shape mix

Layer	File count	Notes
src/Core/**.cs	~2,000	Domain library shared by every service.
src/Api/**.cs	~600	Controllers + request/response models.
src/Sql/**/*.sql	619	Canonical SQL Server schema.
util/Migrator/DbScripts/*.sql	473	Forward-only T-SQL migrations.
util/PostgresMigrations, util/MySqlMigrations, util/SqliteMigrations	~900 combined	EF migrations per provider.
.github/workflows/*.yml	19	CI workflows: build, test, scan, publish, release, ephemeral env, load-test, code-references.

Activity

• Total commits: 7,164.
• Commits in the last 90 days: 480.
• Commits since 2024-01-01: 2,867 — roughly 40 % of all history is from the last ~2.5 years, reflecting accelerating engineering investment.
• Commits per year (selection):

Year	Commits
2017	1,005
2020	466
2023	636
2024	1,034
2025	1,247
2026 (YTD, 4 months)	586

Bot-attributed commits

Approximately 3,258 of 7,163 commits (45 %) carry an automation signature: Renovate (374 directly authored), GitHub Actions (Github Actions <…> ≈ 56 commits), Dependabot, and the factory-droid[bot] co-author lines. This is a lower bound — work performed via inline AI assistance leaves no trace in git history. The vast majority of these commits are dependency bumps in **/packages.lock.json or generated CI artefacts.

Largest source files (refactor candidates)

File	Lines
bitwarden_license/test/Commercial.Core.Test/Billing/Providers/Services/ProviderBillingServiceTests.cs	2,341
src/Api/Vault/Controllers/CiphersController.cs	1,713
src/Core/Platform/Mail/HandlebarsMailService.cs	1,648
bitwarden_license/test/Commercial.Core.Test/AdminConsole/Services/ProviderServiceTests.cs	1,367
src/Core/AdminConsole/Services/Implementations/OrganizationService.cs	1,219
src/Core/Services/Implementations/UserService.cs	1,218
src/Core/Vault/Services/Implementations/CipherService.cs	1,175
src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs	1,116

These are well-known "god classes". Most have ongoing extraction efforts behind feature flags (e.g. the cipher domain has been migrated to the Bitwarden SDK in util/RustSdk/).

TODO / FIXME / HACK count

TODO   234 occurrences
FIXME  709 occurrences
HACK     2 occurrences

The high FIXME count is dominated by the auto-inserted // FIXME: Update this file to be null safe and then delete the line below paired with #nullable disable — part of the in-progress nullable-reference-types migration. Real follow-ups are tagged with a Bitwarden Jira-style key (e.g. [PM-34798]) and grep cleanly for those.

Tags / releases

The repository has 231 tags, ranging from v1.0.0 (Dec 2015) to the current rolling release cadence (year-month tags like 2026.4.x). Every tag corresponds to a Docker image published to GHCR — see https://github.com/orgs/bitwarden/packages and .github/workflows/release.yml.

Test-to-code ratio

Roughly 908 test files vs ~3,500 production C# files (≈ 1 test file per ~4 production files). Coverage is reported via codecov.yml and the unit-test workflow in .github/workflows/test.yml.

Active subsystems by churn (last 12 months)

The most-touched directories in the last year (rough approximation from git log --since=…):

1. src/Core/Billing/** and src/Billing/** — repeated price-migration / proration / Stripe schedule work.
2. src/Core/AdminConsole/OrganizationFeatures/** — invite links, member-role refactor, bulk auto-confirm.
3. src/Core/Auth/** and src/Identity/** — master-password service, TDE, WebAuthn.
4. src/Sql/dbo/** and util/Migrator/DbScripts/** — schema additions for the above features.
5. src/Core/SecretsManager/** and bitwarden_license/src/Commercial.Core/SecretsManager/** — Secrets Manager continues to mature post-GA.

For ownership of each subsystem, see maintainers. For the historical view, see lore.