Microsoft bug bounty programs
azure.github.io Updated
Microsoft runs 4 public programs on Sorona; 4 pay cash, the most up to $15,000 (Azure SDK for JavaScript).
- Top reward
- $15,000
- Sorona
- Programs
- 4
- 4 pay cash
- Targets in scope
- 26
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
4 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Azure SDK for JavaScript
Sorona · Pays the most of the 4 programs: up to $15,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
|
Azure SDK for JavaScript
Sorona · Bug bounty |
$15k (highest) | – | – | – | $15,000 | Partial | Required | – | Open |
Azure SDK for Python
Sorona · Bug bounty |
$15k | – | – | – | $15,000 | Partial | Required | – | Open |
Azure SDK for .NET
Sorona · Bug bounty |
$15k | – | – | – | $15,000 | Partial | Required | – | Open |
Azure SDK for Java
Sorona · Bug bounty |
$15k | – | – | – | $15,000 | Partial | Required | – | Open |
-
- Critical
- $15k (highest)
- High
- –
- Medium
- –
- Low
- –
- Safe harbor
- Partial
- KYC
- Required
-
- Critical
- $15k
- High
- –
- Medium
- –
- Low
- –
- Safe harbor
- Partial
- KYC
- Required
-
- Critical
- $15k
- High
- –
- Medium
- –
- Low
- –
- Safe harbor
- Partial
- KYC
- Required
-
- Critical
- $15k
- High
- –
- Medium
- –
- Low
- –
- Safe harbor
- Partial
- KYC
- Required
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
26 targets across all 4 programs, each listed once with the programs that cover it. 19 excluded.
-
@azure/core-rest-pipeline and the core packages around it: every pipeline policy, the Node and browser HTTP senders, the client-side authentication helpers and the tracing hooks
Products and areas
Covered by Azure SDK for JavaScript
-
@azure/identity in both runtimes, covering every credential type, the MSAL-backed interactive and broker flows, and the token cache
Products and areas
Covered by Azure SDK for JavaScript
-
azure-core and the modules beneath it: the HTTP pipeline and every policy on it, the Netty and OkHttp transports, the JSON and XML serialization adapters, and the tracing hooks each generated client inherits
Products and areas
Covered by Azure SDK for Java
-
azure-core: the sync and async HTTP pipelines, every policy on them, the transport adapters and the tracing hooks each generated client inherits
Products and areas
Covered by Azure SDK for Python
-
azure-identity: every credential type the library ships, the chained credentials, token acquisition and the token cache
Products and areas
Covered by Azure SDK for Java
-
azure-identity: every credential type, the chained credentials, managed and workload identity, the CLI and environment fallbacks, and the token cache
Products and areas
Covered by Azure SDK for Python
-
Azure.Core: the HTTP pipeline and every policy on it, the response and serialization layer, and the tracing hooks each generated client inherits
Products and areas
Covered by Azure SDK for .NET
-
Azure.Identity: every credential type, DefaultAzureCredential and the chained credentials, managed and workload identity, the developer fallbacks, and the persisted token cache
Products and areas
Covered by Azure SDK for .NET
-
The azure-mgmt-* control-plane clients, and the shared serialization and azure-common code the generator emits against
Products and areas
Covered by Azure SDK for Python
-
The azure-resourcemanager-* control-plane clients and the shared AMQP and Netty modules the data-plane clients build on
Products and areas
Covered by Azure SDK for Java
-
The Azure.ResourceManager.* control-plane clients, and the extension packages that wire the SDK into ASP.NET Core, Azure Functions and the Microsoft.Extensions hosting model
Products and areas
Covered by Azure SDK for .NET
-
The browser build of every package that ships one, its cross-origin behaviour, and whatever the bundle exposes to the embedding page
Products and areas
Covered by Azure SDK for JavaScript
-
The generated data-plane clients across the whole catalogue, Azure.Storage.*, Key Vault, Cosmos, Service Bus, Event Hubs, App Configuration and the rest: request construction, URL and SAS handling, and response deserialization
Products and areas
Covered by Azure SDK for .NET
-
The generated service clients across the whole catalogue, @azure/storage-*, Key Vault, Cosmos, Service Bus, Event Hubs, App Configuration and the rest: request construction, URL and SAS handling, and response model deserialization
Products and areas
Covered by Azure SDK for JavaScript
-
The generated service clients across the whole catalogue, azure-storage-*, Key Vault, Cosmos, Service Bus, Event Hubs, App Configuration and the rest: request construction, URL and SAS handling, and response deserialization
Products and areas
Covered by Azure SDK for Java, Azure SDK for Python
-
The repository's own build, release and publish GitHub Actions workflows, which the program prices in a band of their own
Products and areas
Covered by Azure SDK for .NET, Azure SDK for JavaScript, Azure SDK for Java, Azure SDK for Python
-
The shared core modules that ship inside published packages: @azure/core-util, @azure/core-auth, @azure/abort-controller, @azure/logger and their siblings
Products and areas
Covered by Azure SDK for JavaScript
-
The Spring Cloud Azure integration modules, which are Microsoft-owned code inside this repository and covered on that basis
Products and areas
Covered by Azure SDK for Java
-
The whole of azure/azure-sdk-for-java, which the program names on its SCOPE list under "Azure SDKs, limited to the following", at Critical or Important severity on the most recent actively maintained branch
Products and areas
Covered by Azure SDK for Java
-
The whole of azure/azure-sdk-for-js, which the program names on its SCOPE list under "Azure SDKs, limited to the following", at Critical or Important severity on the most recent actively maintained branch
Products and areas
Covered by Azure SDK for JavaScript
-
The whole of azure/azure-sdk-for-net, which the program names on its SCOPE list under "Azure SDKs, limited to the following", at Critical or Important severity on the most recent actively maintained branch
Products and areas
Covered by Azure SDK for .NET
-
The whole of azure/azure-sdk-for-python, which the program names on its SCOPE list under "Azure SDKs, limited to the following", at Critical or Important severity on the most recent actively maintained branch
Products and areas
Covered by Azure SDK for Python
No target matches. Try part of a host name, such as the company name.
Out of scope 19
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
A defect already covered by another vendor's bounty program, which MSRC declines to pay for a second time
Azure SDK for .NET
-
Azure service-side defects, which belong to Microsoft's separate Azure bounty program: the bug has to live in the client library
Azure SDK for Java
-
Azure service-side defects, which belong to the Microsoft Azure bounty program
Azure SDK for Python Azure SDK for JavaScript
-
Azure service-side defects, which route to the Azure bounty program
Azure SDK for .NET
-
Findings whose impact stays on the local machine, since this repository sits outside the carve-out Microsoft grants to VS Code, Agent Framework, TypeScript, Monaco Editor and PowerShell
Azure SDK for JavaScript Azure SDK for Python Azure SDK for Java Azure SDK for .NET
-
Hackathon repositories and dependency-confusion reports
Azure SDK for Java Azure SDK for JavaScript Azure SDK for Python
-
Hackathon repositories, dependency-confusion reports and publicly disclosed issues
Azure SDK for .NET
-
Issues that have already been publicly disclosed
Azure SDK for Java
-
Microsoft and Azure repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing
Azure SDK for Java Azure SDK for Python Azure SDK for JavaScript
-
Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing
Azure SDK for .NET
-
Moderate and Low severity, which pay $0 at every report quality
Azure SDK for JavaScript Azure SDK for .NET Azure SDK for Python Azure SDK for Java
-
.NET base class library defects, which route to the separate .NET bounty program at a different ceiling: a bug in System.Text.Json or System.Net.Http is not this program's
Azure SDK for .NET
-
Publicly disclosed issues
Azure SDK for JavaScript Azure SDK for Python
-
Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award
Azure SDK for .NET Azure SDK for Java Azure SDK for JavaScript Azure SDK for Python
-
Samples, tutorials, quickstart code and anything under samples/
Azure SDK for Java
-
Samples, tutorials, quickstart code and samples/ directories
Azure SDK for JavaScript Azure SDK for Python Azure SDK for .NET
-
Spring Framework, Jackson, Netty and other upstream third-party library defects, even when this SDK reaches them, because only Microsoft-owned code in the repository counts
Azure SDK for Java
-
Upstream npm dependencies the SDK consumes rather than owns
Azure SDK for JavaScript
-
Upstream PyPI dependencies the SDK consumes rather than owns
Azure SDK for Python
Recent changes
Reward and scope changes across every Microsoft program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under azure.github.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.