sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
M+ ModSecurity + OWASP CRS Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• M+

  ModSecurity + OWASP CRS

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://coreruleset.org

  Web

• Every body processor, covering multipart/form-data, XML, JSON, URL-encoded and raw bodies

  Products and areas

• Request-line, header, query-string and cookie parsing, plus the response-body inspection path on the way back out

  Products and areas

• The Apache, nginx and IIS connectors that hand the request to libmodsecurity3 in the first place

  Products and areas

• The audit log and its serialisation of attacker-controlled request data

  Products and areas

• The complete CRS rule set at every Paranoia Level, including the regex-assembly includes and the rules generated from them

  Products and areas

• The CRS rule groups in full: protocol enforcement, application attack detection, file upload handling, and the anomaly scoring and exclusion packages shipped alongside them

  Products and areas

• The libmodsecurity3 engine in full: rule parsing, the transaction lifecycle, phase handling, transformations, operators and actions

  Products and areas

• Two policies, one target. ModSecurity takes reports through GitHub private vulnerability reporting on owasp-modsecurity/ModSecurity; CRS takes them at [email protected] for the two latest point releases plus the v4.25.x LTS line

  Products and areas

No target matches. Try part of a host name, such as the company name.