Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

docs.rs Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $3,100.

Top reward
$3,100
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • zerocopy

    Sorona · Bug bounty

    Open

    Top reward

    $3,100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://docs.rs/zerocopy

    Web

  • Google's tier file lists google/zerocopy at TIER_OT1, which puts the whole crate in scope on the Open Source Software VRP. A security bug in its own code is a product vulnerability priced at $101 to $3,133.70

    Products and areas

  • Layout computation for slices and dynamically sized types, including the size and alignment maths that decides where a cast ends

    Products and areas

  • Reference casting and the transmute macros: Ref, try_transmute!, transmute_ref! and transmute_mut!, plus the fallible entry points that split a byte slice into a typed value and a remainder

    Products and areas

  • The endian-aware integer types and the other helpers the crate publishes alongside the traits

    Products and areas

  • The no_std build and the minimum-supported-Rust-version code paths, where the safety argument differs from the mainline one and gets less review

    Products and areas

  • The repository and the crates.io release pipeline, which the program prices separately as a supply-chain compromise rather than as a product vulnerability

    Products and areas

  • The safe-transmutation traits and the derives that implement them, FromBytes, IntoBytes, KnownLayout, Immutable and Unaligned among them, along with the layout conditions each derive is supposed to prove before it fires

    Products and areas

  • The unsafe core in full: alignment, padding, provenance, validity invariants and the pointer arithmetic underneath every safe API built on top of it

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything privately disclosed to a third party before Google, which the VRP says will typically not qualify for a reward

  • API ergonomics and documentation issues that carry no soundness consequence

  • Downstream code that uses zerocopy correctly and wraps it unsoundly, a defect in the caller rather than in the crate

  • Miri warnings with no demonstrated, exploitable unsoundness behind them

  • Nightly-only behaviour and anything gated behind an unstable feature

  • Unsoundness in the Rust compiler or in core, which belongs to the Rust project

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under docs.rs: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.