Cryptographic Compliance: 1Password Resolves Hardware Token Configuration Disparity

A researcher reported that 1Password's desktop application allowed hardware security tokens (e.g., YubiKey) to be used without enforcing the token PIN during instantiation, which the researcher viewed as a security vulnerability. 1Password considered the behavior a configuration oversight, declined a standard bug bounty, and will implement hardware token PIN verification in the desktop client in a planned July 2026 update, aligning it with the existing browser-extension behavior.