Authelia bug bounty programs

Authelia programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
AU Authelia Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• AU

  Authelia

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.authelia.com

  Web

• Every second-factor method: TOTP registration and verification, WebAuthn registration and assertion, mobile push and the Duo integration

  Products and areas

• First-factor authentication against the file backend and against LDAP or Active Directory, including the password hashing and the search and bind configuration

  Products and areas

• Password reset, account registration and the email flows behind both, including the identity verification tokens they carry

  Products and areas

• Regulation and rate limiting, the mechanism that gates repeated authentication attempts

  Products and areas

• Session management: the session cookie, its domain and lifetime, inactivity handling, the remember-me path and the session storage backend

  Products and areas

• The access control rule engine in full: domain, subdomain, resource, method, subject and network matching, plus the policy levels from bypass through one-factor to two-factor and deny

  Products and areas

• The API, the health and metrics endpoints, and anything reachable without a session

  Products and areas

• The configuration loader, secret file handling and environment variable expansion

  Products and areas

• The forward-auth endpoints every supported reverse proxy calls, and the headers Authelia returns for the proxy to act on and pass downstream

  Products and areas

• The OpenID Connect provider Authelia implements, covering client registration, every grant type, PKCE handling, the consent flow, token issuance and the userinfo endpoint

  Products and areas

• The policy asks for GitHub private vulnerability reporting on authelia/authelia or email to [email protected], and treats direct messages as a discouraged fallback. It declares no boundary narrower than Authelia itself

  Products and areas

• The storage backends and what is written to them, including secrets, TOTP shares and WebAuthn credentials

  Products and areas

No target matches. Try part of a host name, such as the company name.