Cloudflare bug bounty programs
cfssl.org Updated Part of Cloudflare
Cloudflare runs one public program: a Sorona bug bounty paying up to $1,875.
- Top reward
- $1,875
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 11
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Cloudflare runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
cfssl
Sorona · Bug bounty |
– | $1,875 | $938 | $313 | $1,875 | Partial | – | 10 days promised | Open |
-
- Critical
- –
- High
- $1,875
- Medium
- $938
- Low
- $313
- Safe harbor
- Partial
- First response
- 10 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
11 targets. 7 excluded.
-
https://cfssl.org
Web
-
Certificate transparency plumbing: SCT submission, retrieval and verification
Products and areas
-
Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/cfssl is covered by that asset and again by Open source tools from Cloudflare, and it is absent from the short list of repositories Cloudflare marks ineligible, so the repository is in scope as a whole
Products and areas
-
CSR generation and parsing, X.509 and ASN.1 decoding, and the helpers that read PEM and DER supplied by a caller
Products and areas
-
Signing itself: the local signer, the remote signer client, profile and policy enforcement, and the certificate a request finally produces
Products and areas
-
The auth-key mechanism on the signing API, the check that stands between a network caller and a certificate authority key
Products and areas
-
The bundler and its chain construction, the OCSP responder and its revocation answers, and CRL generation
Products and areas
-
The certificate database and the queries behind it, where issued certificates and revocation state are recorded
Products and areas
-
The CFSSL API server and every endpoint it answers on, including sign, authsign, newcert, newkey, bundle, info, certinfo, init_ca, revoke, ocspsign and health
Products and areas
-
The command-line tools shipped with the server, including cfssl, cfssljson and multirootca, and the config and profile files they parse
Products and areas
-
The TLS scanning package and the transport helpers that fetch, rotate and validate certificates on a caller's behalf
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 7
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Demo, example and test code carried inside the repository
-
Duplicates of findings Cloudflare's internal AI-assisted scanning has already produced
-
Findings submitted without a working proof of concept, which are ineligible at any severity
-
Hardening or standards-conformance issues without a demonstrated security impact
-
Self-hosted-only impact with no Cloudflare production nexus or documented production usage
-
Severity cap to plan around: the org-wide open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org
-
Source-code-only analysis, which the policy rules out however the code reads
Recent changes
Reward and scope changes across every Cloudflare program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under cfssl.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.