FlatBuffers bug bounty programs
flatbuffers.dev Updated
FlatBuffers runs one public program: a Sorona bug bounty paying up to $3,100.
- Top reward
- $3,100
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 10
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program FlatBuffers runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
FlatBuffers
Sorona · Bug bounty |
$3,100 | Partial | – | – | Open |
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
10 targets. 8 excluded.
-
https://flatbuffers.dev
Web
-
Build and release publishing configuration across the package ecosystems the project pushes to, which falls under the supply-chain reward category
Products and areas
-
google/flatbuffers is named at OT1 in Google's tier file, and it sits in a Google-owned GitHub organisation, which the program's scope sentence covers as well. A product vulnerability anywhere in the repository is priced at $101 to $3,133.70
Products and areas
-
JSON to FlatBuffer conversion, the reflection API and FlexBuffers, all of which build buffers from input the caller did not author
Products and areas
-
The C++ runtime: flatbuffers::Verifier and its depth, size and alignment accounting, table and vtable access, FlatBufferBuilder, and the string and vector readers
Products and areas
-
The flatc schema compiler: the .fbs grammar it accepts, schema parsing, includes and namespaces, and the code it generates for each target language
Products and areas
-
The generated code itself, since the bounds checks a consumer relies on are the ones flatc chose to emit
Products and areas
-
The gRPC integration the repository ships alongside the runtimes
Products and areas
-
The language runtimes shipped in-repo: Java, Kotlin, C#, Go, Python, Rust, Swift, TypeScript, PHP, Dart, Lua and C
Products and areas
-
Zero-copy accessor generation and vtable offset handling, where a bad offset turns a read into an out-of-bounds access
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue
-
Consuming an unverified buffer without calling the verifier, which the documentation explicitly requires you to do
-
Memory-corruption reports without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch, which the program requires on every OT0 and OT1 repository
-
Performance characteristics of the zero-copy design itself
-
Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject
-
Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward
-
Schema evolution and compatibility issues with no security impact
-
Third-party FlatBuffers implementations that are not in the tier file
Recent changes
Reward and scope changes across every FlatBuffers program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under flatbuffers.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.