pyca/cryptography bug bounty programs

pyca/cryptography programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
PY pyca/cryptography Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	2 days promised	Open
PC Python Cryptographic Authority HackerOne · Disclosure only	–	–	–	–	No cash	–	–	–	Paused

• PY

  pyca/cryptography

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

  First response

  2 days promised

• PC

  Python Cryptographic Authority

  HackerOne · Disclosure only

  Paused

  Top reward

  No cash

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• *.cryptography.io

  Wildcards No bounty

  Covered by HackerOne

• *.pyopenssl.org

  Wildcards No bounty

  Covered by HackerOne

• https://cryptography.io

  Web

  Covered by Sorona

• https://github.com/pyca/bcrypt

  Source code No bounty

  Covered by HackerOne

• https://github.com/pyca/cryptography

  Source code No bounty

  Covered by HackerOne

• https://github.com/pyca/infra

  Source code No bounty

  Covered by HackerOne

• https://github.com/pyca/pynacl

  Source code No bounty

  Covered by HackerOne

• https://github.com/pyca/pyopenssl

  Source code No bounty

  Covered by HackerOne

• Key and certificate serialisation in every format the library reads or writes, including PEM, DER, PKCS#8, PKCS#12 and the OpenSSH key formats

  Products and areas

  Covered by Sorona

• The asymmetric implementations and the parameter and point validation around them, spanning RSA, DSA, the elliptic curve families, Ed25519 and X25519

  Products and areas

  Covered by Sorona

• The build and release tooling that produces the wheels, where a supply chain defect reaches every consumer at once

  Products and areas

  Covered by Sorona

• The Fernet recipe layer, which is the high-level API most application code actually calls

  Products and areas

  Covered by Sorona

• The hazmat primitive layer, covering the ciphers and their modes, AEAD tag verification, the hash and MAC families, and the key derivation functions

  Products and areas

  Covered by Sorona

• The OpenSSL binding surface, covering error handling, memory ownership and every place a return value from the C library is interpreted

  Products and areas

  Covered by Sorona

• The OpenSSL build vendored into the published binary wheels, since a defect in it ships to anyone who installed from PyPI

  Products and areas

  Covered by Sorona

• The published policy asks for any suspected security issue in the library through the GitHub advisory channel and draws no boundary narrower than the project itself, so the whole tree is the target

  Products and areas

  Covered by Sorona

• The Rust extension and the boundary between it and the Python layer, where a check enforced on one side may be absent on the other

  Products and areas

  Covered by Sorona

• The two-factor primitives, TOTP and HOTP, and their verification behaviour

  Products and areas

  Covered by Sorona

• The x509 module in full: certificate and CSR parsing, chain building, path validation, name constraints, SAN handling, CRL and OCSP

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.