Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

DuckDB bug bounty programs

duckdb.org Updated

DuckDB runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program DuckDB runs.

  • DuckDB

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 6 excluded.

  • https://duckdb.org

    Web

  • Every client binding and its interop layer, covering the Python, R, Java, Node, Rust and WASM builds and the conversion between host objects and engine values

    Products and areas

  • Every file format reader and writer the engine ships, including Parquet, CSV, JSON, Arrow and the compression codecs behind them

    Products and areas

  • Remote filesystem access through httpfs and the object-store paths, covering URL handling, redirects and the credentials held for them

    Products and areas

  • The CLI shell, including its dot-commands and output handling

    Products and areas

  • The extension mechanism end to end: resolution, download, signature verification, loading and the ABI an extension is trusted across

    Products and areas

  • The native database file format, its write-ahead log and the code that opens a .duckdb file handed over by someone else

    Products and areas

  • The published policy asks for any potential security issue through the repository's private advisory form and draws no boundary narrower than the DuckDB tree itself

    Products and areas

  • The secrets and encryption surface, including how keys are held in memory and written to disk

    Products and areas

  • The SQL front end in full: the parser, the binder, the optimizer and every function the engine exposes

    Products and areas

  • The vectorized execution engine and the operators that run over decoded data in memory

    Products and areas

  • User-defined functions, replacement scans and any other callback where host code and engine code cross

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A host application that hands the engine untrusted SQL with full filesystem permissions and no sandbox, which is an integration decision

  • Community extensions maintained outside the DuckDB organisation, unless the defect is in how the core loads or verifies them

  • MotherDuck's hosted service, a separate commercial product built on DuckDB rather than the engine itself

  • Resource exhaustion from a deliberately expensive query on an engine that was designed to use the whole machine

  • Security issues filed as public GitHub issues rather than through the advisory form

  • Upstream dependency vulnerabilities, unless DuckDB's own use of the dependency is what makes them reachable

Recent changes

Reward and scope changes across every DuckDB program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in DuckDB products, from the NVD.

Search NVD
  • CVE-2026-111497 Critical

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie

  • CVE-2025-64429 Medium

    DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on

  • CVE-2024-41672 High

    DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First

About this page

This page gathers every public program listed under duckdb.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.