Apptainer bug bounty programs

Apptainer programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
AP Apptainer Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• AP

  Apptainer

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://apptainer.org

  Web

• FUSE-based image mounting as Apptainer invokes it, covering squashfuse, fuse2fs and gocryptfs

  Products and areas

• GPU and device passthrough setup for NVIDIA and ROCm, including the host libraries bound into the container

  Products and areas

• Image signature verification, key handling and the encrypted-image support

  Products and areas

• Instance mode, its lifecycle and the sockets and state files behind it

  Products and areas

• Network configuration through CNI plugins where the privileged path sets it up

  Products and areas

• OCI and Docker image conversion, layer extraction and the caching of pulled layers

  Products and areas

• Overlay and bind mount setup, including the underlay path and every mount performed before privilege is dropped

  Products and areas

• SIF image format parsing in full: the header, the descriptor table and every data object inside a container file

  Products and areas

• The build path, including builds from definition files, the %post script execution model and builds from Docker or OCI sources

  Products and areas

• The published security policy asks for reports to the project security address and declares one boundary: attacker-controlled content inside a container image is not treated as a risk to the user who runs it, while privilege escalation arising from image content is a valid concern

  Products and areas

• The setuid starter binary and the entire privileged startup path, including exactly where privilege is dropped

  Products and areas

• The site configuration file and the enforcement of an administrator's bind path restrictions, allowed capabilities and limits

  Products and areas

• The user namespace startup path and the id mapping it establishes

  Products and areas

No target matches. Try part of a host name, such as the company name.