Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Flutter bug bounty programs

flutter.dev Updated Part of Google

Flutter runs one public program: a Sorona bug bounty paying up to $7,500.

Top reward
$7,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Flutter runs.

  • Flutter

    Sorona · Bug bounty

    Open

    Top reward

    $7,500
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 8 excluded.

  • https://flutter.dev

    Web

  • DevTools: the debug service connection, VM Service protocol exposure and the DevTools web application itself

    Products and areas

  • flutter_tools: the build pipeline, pub dependency resolution, artifact download and verification, and the code-signing steps that produce a shippable binary

    Products and areas

  • Google's tier file names two repositories: flutter/flutter at OT0, where a product vulnerability is priced at $500 to $7,500, and flutter/devtools at OT1, capped at $3,133.70. Both are covered whole, with no component of either carved out

    Products and areas

  • Image, font and asset decoding paths reached from network content, including malformed media that reaches a decoder before any application check

    Products and areas

  • Platform channels and the method, event and message channel boundary between Dart and native code, the crossing from framework code into platform privileges

    Products and areas

  • The engine shipped in the same repository, including dart:ui, the Skia and Impeller rasterisers, and text shaping

    Products and areas

  • The flutter CLI itself, including channel switching and the version and artifact management it performs

    Products and areas

  • The framework layers: widgets, rendering, gestures, animation, and the semantics tree assistive technology reads

    Products and areas

  • The platform embedders for Android, iOS, macOS, Windows, Linux and the web, and the platform views that host native widgets inside a Flutter surface

    Products and areas

  • Web rendering output from both the CanvasKit and HTML renderers, and any markup the framework emits into the page

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Applications written in Flutter rather than defects in the framework that ships to them

  • Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue

  • Debug-mode-only behaviour that is documented as insecure and disabled in release builds

  • Platform-specific bugs owned by Android or iOS rather than by Flutter's own code

  • Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject

  • Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward

  • The Dart SDK and language runtime, which is a separate tier-file entry (dart-lang/sdk) with its own band

  • The plugins in flutter/packages, which the tier file does not name, along with third-party packages published on pub.dev

Recent changes

Reward and scope changes across every Flutter program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Flutter products, from the NVD.

Search NVD
  • CVE-2026-27704 Medium

    The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed

  • CVE-2024-54462 Low

    The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.8.12+18. It is recommended to up

  • CVE-2024-54461 Low

    The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.5.1+12. It is recommended to

  • CVE-2022-3095 Critical

    The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.

About this page

This page gathers every public program listed under flutter.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.