DokuWiki bug bounty programs

DokuWiki programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
DO DokuWiki Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• DO

  DokuWiki

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.dokuwiki.org

  Web

• The ACL engine and the rules file it evaluates, which decides read, edit, create, upload and delete rights per namespace and per user or group

  Products and areas

• The authentication plugin interface and the bundled backends, covering plain-file accounts, LDAP, Active Directory and the SQL backends

  Products and areas

• The configuration manager and the installer, both of which write files that change how the wiki authenticates and authorises

  Products and areas

• The media manager: upload handling, MIME and extension checking, storage layout and the routes that serve uploaded files back to a browser

  Products and areas

• The page storage layer and the path handling that maps a page identifier to a file on disk, including the attic and meta directories

  Products and areas

• The parser and renderer, covering the syntax layer, the instruction cache and the settings that allow raw HTML or PHP in page content

  Products and areas

• The plugin and template manager, which downloads archives over the network and unpacks them into the installation

  Products and areas

• The project publishes a list of what does not qualify rather than a positive scope statement, and asks for everything else by email to the maintainer. Anything in the DokuWiki tree that the non-qualifying list does not cover is inside that

  Products and areas

• The search index and its incremental update path, where results can cross content the searcher cannot read

  Products and areas

• The XML-RPC and JSON-RPC remote API, and the permission checks it applies compared with the web interface

  Products and areas

No target matches. Try part of a host name, such as the company name.