ESPHome bug bounty programs

ESPHome programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
ES ESPHome Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• ES

  ESPHome

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://esphome.io

  Web

• Protocol components that read data from external hardware, covering the infrared and RF remote receivers, the Zigbee, Modbus, UART and CAN bus components and the long tail of sensor drivers

  Products and areas

• The Bluetooth Low Energy components: the BLE tracker, the proxy that relays another device's traffic back to Home Assistant, and every BLE client component that parses advertisements

  Products and areas

• The bundled web server component and its authentication, along with the captive portal and improv provisioning flows that run before a device is on the network

  Products and areas

• The ESPHome dashboard and its API, which builds and flashes firmware and holds every device's secrets

  Products and areas

• The MQTT client, the credentials it holds, and both what it publishes and what it accepts from a broker

  Products and areas

• The native API server, the protocol Home Assistant uses to talk to a device, including its noise encryption handshake and the authentication that gates it

  Products and areas

• The over-the-air update path: the OTA password check, the transfer protocol and the image validation that decides what firmware gets written to flash

  Products and areas

• The policy accepts security vulnerabilities in ESPHome and points reporters at a published threat model that defines the trust boundaries. Anyone who can edit a device configuration counts as trusted, and everything below sits outside that trusted position

  Products and areas

• The Python build toolchain that compiles a configuration into firmware, including config validation and the external components mechanism

  Products and areas

• Wi-Fi provisioning and stored credentials, including whatever a device leaks while it is sitting in access-point mode

  Products and areas

No target matches. Try part of a host name, such as the company name.