Directus bug bounty programs

Directus programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
DI Directus Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• DI

  Directus

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://directus.io

  Web

• Authentication across every method the product supports: local login, refresh-token handling, static API tokens, and the OAuth2, OpenID Connect, LDAP and SAML providers

  Products and areas

• File storage and the asset endpoint, including image transformation, storage adapters and the routes that serve files back

  Products and areas

• Flows and Operations, the automation runtime that fires on triggers and executes work with the project's own credentials

  Products and areas

• Schema management, migrations and the import and export routines that read and write project data in bulk

  Products and areas

• The admin app in its entirety, and every setting an administrator can change on a running project

  Products and areas

• The extensions API and the sandbox around custom endpoints, hooks, operations and interfaces

  Products and areas

• The GraphQL API, including the schema it generates from a project's collections and the resolvers behind it

  Products and areas

• The permissions and access-policy engine end to end, covering role assignment, collection and field-level rules, item-level filter rules and the filter language those rules are written in

  Products and areas

• The policy asks for any vulnerability through a GitHub private advisory or the security address, and draws no boundary narrower than the Directus platform itself

  Products and areas

• The realtime and websocket subscription layer, which pushes item changes to connected clients under the same permission rules

  Products and areas

• The REST API in full: every collection, item, field and relational endpoint a client can reach, whatever is on the other end

  Products and areas

No target matches. Try part of a host name, such as the company name.