Oven bug bounty programs
bun.com Updated
Oven runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 11
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Oven runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Bun
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | 5 days promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
- First response
- 5 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
11 targets. 6 excluded.
-
https://bun.com
Web
-
bun install end to end: registry communication, lockfile parsing, tarball extraction, dependency resolution and lifecycle script execution
Products and areas
-
bunx and the single-file executable builder, both of which fetch or embed code and then run it
Products and areas
-
The built-in HTTP server, the WebSocket server and the fetch implementation, all of which handle input straight off the network
Products and areas
-
The bundled SQLite, filesystem, shell and subprocess APIs Bun exposes to JavaScript, and the boundary checks around them
Products and areas
-
The bundler and the transpiler, which parse untrusted source and emit code that will later run
Products and areas
-
The macro and plugin system, which runs code during a build
Products and areas
-
The Node.js compatibility layer, where Bun reimplements node: modules and a semantic difference from Node can become a security difference
Products and areas
-
The runtime and its JavaScriptCore embedding, including the native bindings and the Zig code that bridges the engine to the host
Products and areas
-
The security policy names a single address and draws no scope boundary at all, so anything the bun binary does is in. The list below is the component surface rather than a carve-out
Products and areas
-
The test runner and its module loading, which executes repository code on CI machines
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
JavaScriptCore itself, WebKit's engine, which carries its own security process
-
Node compatibility gaps with no security consequence, which are ordinary bugs
-
npm packages a project installs, unless Bun's own resolution, extraction or script handling is what makes the defect reachable
-
Oven's website and hosted infrastructure, since the policy is about the runtime
-
Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary
-
Zig and LLVM defects in the toolchain that builds Bun, as distinct from Bun's own code
Recent changes
Reward and scope changes across every Oven program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under bun.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.