Homebrew bug bounty programs

Homebrew programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
HO Homebrew Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
HO Homebrew HackerOne · Disclosure only	–	–	–	–	No cash	–	–	–	Paused

• HO

  Homebrew

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• HO

  Homebrew

  HackerOne · Disclosure only

  Paused

  Top reward

  No cash

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://brew.sh

  Web

  Covered by Sorona

• brew shellenv, shell completions and everything Homebrew writes into a user's shell profile

  Products and areas

  Covered by Sorona

• brew update and the autoupdate path, the most frequently exercised code in the tool and the one every later install depends on

  Products and areas

  Covered by Sorona

• Cask installation, where packages and vendor installers run with elevated privileges

  Products and areas

  Covered by Sorona

• Checksum verification on source tarballs and on bottles, plus the bottle fetch from GitHub Packages

  Products and areas

  Covered by Sorona

• Download strategies, covering curl fetches, Git and other VCS clones, and how a URL supplied by a formula is handled

  Products and areas

  Covered by Sorona

• Formula and cask evaluation, which is Ruby from a tap executed on the user's machine as part of an install

  Products and areas

  Covered by Sorona

• Homebrew publishes no scope statement beyond the advisory form itself. The channel takes vulnerabilities in Homebrew, and nothing narrower than that has been written down anywhere

  Products and areas

  Covered by Sorona

• The brew client in full: the Ruby codebase, the whole command set and the DSL that formulae and casks are written in

  Products and areas

  Covered by Sorona

• The CI and formula-review automation across the Homebrew organisation, including the bots and workflows that act on pull requests. Historically this is where the most serious findings have landed

  Products and areas

  Covered by Sorona

• The JSON API on formulae.brew.sh that current clients read instead of cloning taps

  Products and areas

  Covered by Sorona

• The prefix permission model under /opt/homebrew and /usr/local, including anything letting a local user influence what a later install writes or executes

  Products and areas

  Covered by Sorona

• The tap mechanism: adding a tap, updating one over Git, and the trust boundary between a third-party tap and core

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.