Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Astra Linux bug bounty programs

bi.zone Updated

Astra Linux runs two public programs: a Sorona bug bounty paying up to RUB 250,000 and a Sorona bug bounty paying up to RUB 100,000.

Top reward
RUB 250,000
Sorona
Programs
2
2 pay cash
Targets in scope
15
2 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Astra Linux Special Edition 1.8.6

Sorona · Pays the most of the 2 programs: up to RUB 250,000.

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

15 targets across all 2 programs, each listed once with the programs that cover it. 9 excluded.

  • https://bugbounty.bi.zone/companies/ald-pro/main

    Web

    Covered by ALD Pro (Astra Linux Directory Pro)

  • https://bugbounty.bi.zone/companies/astralinux-new/main

    Web

    Covered by Astra Linux Special Edition 1.8.6

  • All of the above as shipped in ALD Pro 3.2.1, the version distributed as the programme's research VM image and its defined testing target

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

  • Client-side enrolment and the agent software running on joined hosts, plus monitoring through Zabbix, log handling through syslog-ng and time synchronisation through Chrony

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

  • Domain services reachable across the network from a host that has no credentials yet: DNS through BIND 9, address assignment through ISC DHCP, network boot through TFTP-HPA, printing through CUPS and file sharing through Samba

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

  • Everything a domain controller runs as installed, since that host is where those components are wired together and where the product's own integration and management layer sits on top of them

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

  • Mandatory access control end to end: the kernel enforcement, the policy and label configuration, and the userspace tooling that sets it. Any path letting a subject read, write or execute across a label the system is certified to hold sits inside this

    Products and areas

    Covered by Astra Linux Special Edition 1.8.6

  • Package distribution through Reprepro, the path by which an ALD Pro estate receives its software updates

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

  • The closed software environment: signature verification, the execution restrictions deciding what is permitted to run at all, and the paths that install or update what the system trusts

    Products and areas

    Covered by Astra Linux Special Edition 1.8.6

  • The Debian 12 base and its repository of more than twenty thousand packages, insofar as a defect there reaches Astra's protection layer. The open-source share of this target is partial and the certified layer above it is proprietary

    Products and areas

    Covered by Astra Linux Special Edition 1.8.6

  • The directory and authentication core: LDAP handling in 389 DS, ticket issue and validation in the MIT KDC, and the FreeIPA management framework with its web interface and its API

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

  • The rest of the operating system as it ships on the supplied image, insofar as a defect there defeats one of those mechanisms: the kernel, the system services that start with it, and the privileged and setuid binaries the distribution installs

    Products and areas

    Covered by Astra Linux Special Edition 1.8.6

  • The SaltStack-based configuration and orchestration path, which by design executes instructions from the domain controller on every joined machine

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

  • What the programme names as its target is the operating system's protection mechanisms, mandatory access control and the closed software environment, tested against a research virtual machine the programme supplies rather than against a website. The ladder runs Low, Medium and High, with no critical tier defined at all

    Products and areas

    Covered by Astra Linux Special Edition 1.8.6

  • What the programme's own rules declare: ALD Pro "является деривативом… программного обеспечения с открытым исходным кодом", and the rules then name the components it derives from. Those components as integrated and shipped in the product are the target: FreeIPA, 389 Directory Server, MIT Kerberos KDC, Samba, BIND 9, Chrony, ISC DHCP, TFTP-HPA, CUPS, syslog-ng, Zabbix, SaltStack and Reprepro

    Products and areas

    Covered by ALD Pro (Astra Linux Directory Pro)

No target matches. Try part of a host name, such as the company name.

Out of scope 9

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A critical band. The programme defines Low, Medium and High only, so RUB 250,000 is the top of the ladder rather than a rung below something bigger

    Astra Linux Special Edition 1.8.6

  • Any expectation of a critical band: the grid defines Low, Medium and High only, and nothing is priced above RUB 100,000

    ALD Pro (Astra Linux Directory Pro)

  • Anything outside the supplied research image, including other Astra products such as ALD Pro, which BI.ZONE runs as a separate programme with its own grid

    Astra Linux Special Edition 1.8.6

  • Anything you cannot demonstrate on the supplied research VM image, since that image is the programme's defined testing target

    ALD Pro (Astra Linux Directory Pro)

  • Astra Linux Special Edition itself, which BI.ZONE runs as a separate programme against its own proprietary mandatory-access-control and closed-software-environment mechanisms

    ALD Pro (Astra Linux Directory Pro)

  • Hosted websites and services. The programme is scoped to the operating system on a supplied virtual machine rather than to a web target

    Astra Linux Special Edition 1.8.6

  • Known CVEs published more than thirty days before the research VM image went up, which the rules place outside the reward entirely

    ALD Pro (Astra Linux Directory Pro)

  • Scope detail beyond the published component list, which sits behind the platform's login and must be confirmed inside an account rather than assumed from this page

    ALD Pro (Astra Linux Directory Pro)

  • Upstream Debian and upstream package defects with no demonstrated effect on Astra's protection mechanisms, which are what the programme names

    Astra Linux Special Edition 1.8.6

Recent changes

Reward and scope changes across every Astra Linux program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under bi.zone: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.