Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processes

This appears to be a problem with window's security model. Not only BW has this problem, 1P has this problem as well, and presumably other password managers that allow such convenience too. The only way is not to persist the encryption key/password/secret across app restart.

See

• https://community.bitwarden.com/t/does-bitwarden-save-master-password-in-tpm/31292/18
• https://support.1password.com/windows-hello-security/