Docusaurus bug bounty programs
docusaurus.io Updated
Docusaurus runs one public program: a Sorona bug bounty.
- Top reward
- Not published
- Programs
- 1
- 1 pays cash
- Targets in scope
- 8
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Docusaurus runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Docusaurus
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
8 targets. 8 excluded.
-
https://docusaurus.io
Web
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/docusaurus sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
-
The build pipeline: configuration loading, plugin and preset resolution, the webpack and static-generation steps, and the output they emit
Products and areas
-
The CLI and its start, build, serve, swizzle, deploy and write-translations commands, the dev server included
Products and areas
-
The client runtime that ships to readers, covering the router, link and history handling, the search UI and the theme components
Products and areas
-
The Markdown and MDX pipeline end to end: front matter, remark and rehype plugins, admonitions, code blocks and the HTML that content compiles into
Products and areas
-
The packages the project publishes under @docusaurus/: core, the classic preset, the theme packages, and the official plugins for docs, blog, pages, sitemap, search and client redirects
Products and areas
-
Versioning, internationalisation and translation loading, where content and metadata are read off disk and merged
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions
-
Defects in a third-party theme or plugin, or in a downstream site's own content, rather than in Docusaurus itself
-
Duplicates. Meta pays the first reporter only
-
Extremely low-risk issues, which Meta states may not qualify for a bounty at all
-
Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on
-
Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list
-
Self-XSS, and anything that needs the site owner to author hostile documentation. Whoever writes the docs already controls what the build emits
-
Server-side attack scenarios asserted rather than demonstrated. Docusaurus emits a static site, so a server-side claim has to show how the code runs at request time at all
Recent changes
Reward and scope changes across every Docusaurus program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under docusaurus.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.