Bouncy Castle bug bounty programs

Bouncy Castle programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
BC Bouncy Castle Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• BC

  Bouncy Castle

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.bouncycastle.org

  Web

• CMS, S/MIME, PKCS#7, PKCS#12 and the certificate management protocols the project implements, including CMP and EST

  Products and areas

• The ASN.1 layer underneath all of the above, which decodes attacker-supplied structure before any signature has been checked

  Products and areas

• The FIPS distributions and their self-test and boundary machinery

  Products and areas

• The JCE and JCA provider surface: every algorithm registered through it, and the parameter handling on the way in

  Products and areas

• The lightweight API, which callers use directly to reach primitives without going through the provider framework

  Products and areas

• The OpenPGP implementation and everything it parses, which handles data supplied entirely by a third party

  Products and areas

• The PKIX stack: certificate parsing, path building and validation, name constraints, CRL and OCSP handling

  Products and areas

• The public key implementations across RSA, DSA, the elliptic curve families, the national algorithm suites such as GOST and SM2, and the post-quantum algorithms the project has added

  Products and areas

• The published policy asks for security reports at the dedicated mailbox and commits to opening an advisory. It sets out a workflow rather than a component boundary, so treat the whole provider as in scope across both the Java and C# distributions

  Products and areas

• The symmetric ciphers and their modes, including the AEAD constructions, tag verification and the counter and IV handling that recent findings landed in

  Products and areas

• The TLS and DTLS implementation and the JSSE provider built on it, covering handshake state, the record layer and the trust decisions in between

  Products and areas

• The utility and encoding surface, including the base64, hex and PEM handling that parses input a caller did not produce

  Products and areas

No target matches. Try part of a host name, such as the company name.