Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Bazel bug bounty programs

bazel.build Updated Part of Google

Bazel runs one public program: a Sorona bug bounty paying up to $7,500.

Top reward
$7,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Bazel runs.

  • Bazel

    Sorona · Bug bounty

    Open

    Top reward

    $7,500
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 8 excluded.

  • https://bazel.build

    Web

  • bazelbuild/continuous-integration, the CI infrastructure configuration that Bazel's own releases are built on

    Products and areas

  • bzlmod module resolution, registry fetching, lockfile generation and lockfile verification, where a gap substitutes one dependency for another

    Products and areas

  • Google's tier file names three repositories at OT0: bazelbuild/bazel, bazelbuild/bazel-central-registry and bazelbuild/continuous-integration. A product vulnerability anywhere in the three is priced at $500 to $7,500, and a compromise of the registry, the repositories or the release pipeline falls in the separate supply-chain category at $3,133.70 to $31,337

    Products and areas

  • Installer and release artifacts, repository configuration, GitHub Actions workflows and release signing across all three repositories, which Google prices as the supply-chain category

    Products and areas

  • Remote execution and remote caching clients, including action key derivation and the decision to trust a result computed on another machine

    Products and areas

  • The Bazel Central Registry: module metadata, the source archive integrity hashes it publishes, patch files, and the presubmit and publishing flow that admits a new module version

    Products and areas

  • The Bazel server and its client protocol, the build event service, and the persistent worker protocol

    Products and areas

  • The build engine end to end: loading, analysis and execution, the action graph, and the local sandbox implementations that are supposed to confine an action

    Products and areas

  • The network fetching layer: http_archive, checksum verification, netrc and credential-helper handling, and proxy support

    Products and areas

  • The Starlark interpreter and everything it evaluates: BUILD files, .bzl files, WORKSPACE, MODULE.bazel, and repository rules that fetch and execute external content

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue

  • Build breakage, incorrect output and performance regressions that carry no security consequence

  • Insider-only risks, which the rules downgrade to credit rather than a reward

  • Issues that require a malicious BUILD or MODULE.bazel file the developer already chose to run, absent a realistic non-maintainer attack path

  • Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject

  • Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward

  • Third-party Bazel rulesets outside the bazelbuild organisation, which are not listed in Google's repository tier file

  • Vulnerabilities in the third-party CI platforms Bazel uses, which the program rules place explicitly out of scope

Recent changes

Reward and scope changes across every Bazel program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under bazel.build: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.