cert-manager bug bounty programs

cert-manager programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
CM cert-manager Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	3 days promised	Open

• CM

  cert-manager

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://cert-manager.io

  Web

• Secret handling end to end: creation, ownership, the reference model between namespaces, and the garbage collection behaviour

  Products and areas

• The ACME implementation in full, covering account registration, order and authorization handling, and the Challenge and Order resources the controller creates and consumes

  Products and areas

• The admission webhooks and the CRD validation they perform, where a malformed or crafted resource reaches the controller

  Products and areas

• The CA and SelfSigned issuers and their handling of signing key material held in secrets

  Products and areas

• The controller reconciliation loops for Certificate, CertificateRequest, Issuer and ClusterIssuer, along with the state transitions between them

  Products and areas

• The DNS01 solvers and every provider integration shipped in the organisation, together with the credentials they read from cluster secrets

  Products and areas

• The HTTP01 solver, including the temporary Ingress or Gateway resources and the pods it creates in a cluster to answer a challenge

  Products and areas

• The Issuer policy surface: the solver selectors, the allowed domain configuration, and every rule that decides whether a given request may be fulfilled

  Products and areas

• The Kubernetes API interactions themselves, covering watch handling, cache behaviour and the resilience of the controller to hostile resource content

  Products and areas

• The policy declares its covered repositories explicitly: everything under the cert-manager GitHub organisation. That declaration is the scope, and the components below sit inside it

  Products and areas

• The RBAC and service account model the project ships, where an over-broad default role is a real finding

  Products and areas

• The sub-projects under the same organisation, including the CSI driver, trust-manager, approver-policy and the istio-csr integration

  Products and areas

• The Vault and Venafi issuer integrations and the credentials and tokens they hold

  Products and areas

No target matches. Try part of a host name, such as the company name.