ClickHouse bug bounty programs

ClickHouse programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
CL ClickHouse Bugcrowd · Bug bounty	$2,500 (highest)	$1,250 (highest)	$600 (highest)	$100 (highest)	$2,500	Full	–	–	Open
CL ClickHouse Sorona · Bug bounty	$2,500	$1,250	$600	$100	$2,500	Partial	–	5 days promised	Open

• CL

  ClickHouse

  Bugcrowd · Bug bounty

  Open

  Top reward

  $2,500

  Critical

  $2,500 (highest)

  High

  $1,250 (highest)

  Medium

  $600 (highest)

  Low

  $100 (highest)

  Safe harbor

  Full

• CL

  ClickHouse

  Sorona · Bug bounty

  Open

  Top reward

  $2,500

  Critical

  $2,500

  High

  $1,250

  Medium

  $600

  Low

  $100

  Safe harbor

  Partial

  First response

  5 days promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://clickhou.se/bugcrowd

  Web

  Covered by Bugcrowd

• https://clickhouse.com

  Web

  Covered by Sorona

• https://cloud.langfuse.com

  Web

  Covered by Bugcrowd

• Authentication and the access-control model that separates tenants inside one cluster: users, roles, quotas, row policies and the LDAP and Kerberos paths

  Products and areas

  Covered by Sorona

• ClickHouse Cloud environment hosted by ClickHouse

  Products and areas

  Covered by Bugcrowd

• clickhouse-keeper, the Raft coordination service, and the clickhouse-client and clickhouse-local binaries shipped from the same repository

  Products and areas

  Covered by Sorona

• ClickHouse-operated web properties, as secondary assets; the target list is deliberately narrow at a scope rating of 1 of 4

  Products and areas

  Covered by Sorona

• clickhouse-server and everything a client can reach on it: the native TCP protocol, the HTTP interface, and the MySQL and PostgreSQL wire-protocol emulation

  Products and areas

  Covered by Sorona

• https://github.com/ClickHouse/ClickHouse

  Products and areas

  Covered by Bugcrowd

• Table engines and the MergeTree storage layer, plus replication and distributed query execution across a cluster

  Products and areas

  Covered by Sorona

• Table functions and external integrations: S3, URL, File, HDFS, the JDBC and ODBC bridges, and the Kafka, MySQL and PostgreSQL engines

  Products and areas

  Covered by Sorona

• The engagement asks researchers to "help us identify vulnerabilities in our open-source assets", and the repository's SECURITY.md routes every ClickHouse vulnerability report here, so the open-source engine is in scope in full across the P1 to P4 ladder

  Products and areas

  Covered by Sorona

• The input and output formats and the compression codecs, which are the widest untrusted-data surface the server has

  Products and areas

  Covered by Sorona

• The SQL surface: the parser, the analyser and the interpreter, along with the functions and aggregate functions the query engine exposes

  Products and areas

  Covered by Sorona

• User-defined and executable functions, which run code the server was configured to trust

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.