Frappe bug bounty programs
frappe.io Updated
Frappe runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 20
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Frappe Framework
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Frappe Framework
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | 10 days promised | Open |
|
Frappe
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | 15 days promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
- First response
- 10 days promised
-
- First response
- 15 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
20 targets across all 2 programs, each listed once with the programs that cover it. 12 excluded.
-
Authentication across every backend the framework ships: password login, API keys and secrets, OAuth2 provider mode, LDAP, SAML and social login
Products and areas
Covered by Sorona
-
Bench, site configuration and the app installation mechanism that adds code to a running site
Products and areas
Covered by Sorona
-
File and attachment handling: upload, the private and public file split, and the access check on download
Products and areas
Covered by Sorona
-
Server scripts and client scripts, the mechanism by which an administrator's stored configuration becomes executed code
Products and areas
Covered by Sorona
-
Session management, the two-factor implementation and the rate limiting in front of login
Products and areas
Covered by Sorona
-
The doctype layer and the ORM built on it: document creation, validation, saving, submission and cancellation, and the hooks applications attach to each stage
Products and areas
Covered by Sorona
-
The Jinja templating used for print formats, notifications, web pages and email, the framework's main server-side template evaluation surface
Products and areas
Covered by Sorona
-
The permission engine in full, covering role permissions, user permissions, document sharing, permission levels on individual fields and the owner and if_owner rules
Products and areas
Covered by Sorona
-
The policy points every report at the frappe.io/security intake and states no component boundary, so the whole framework is in scope, including everything an application inherits from it
Products and areas
Covered by Sorona
-
The query builder and the report engine, including query reports where an administrator supplies raw SQL and the list-view filters that build queries from user parameters
Products and areas
Covered by Sorona
-
The REST resource API over doctypes, which exposes create, read, update and delete on any document type to an authenticated consumer
Products and areas
Covered by Sorona
-
The website and portal layer, including web forms, web pages and every route the framework serves to an unauthenticated visitor
Products and areas
Covered by Sorona
-
The whitelisted-method RPC surface reachable at /api/method, which is how the desk interface and every client call into the server
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 12
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
build.erpnext.com
Self-hosted
-
discuss.erpnext.com
Self-hosted
-
erpnext.atlassian.net
Self-hosted
-
gateway.erpnext.com
Self-hosted
-
A role or user permission an administrator granted deliberately
Sorona
-
Bench and deployment configuration choices, including a site run without the documented hardening
Sorona
-
Credential or Info leak in test files
Self-hosted
-
Defects in ERPNext or in another Frappe application's business logic, which belong on that application's own entry
Sorona
-
Github Wikis
Self-hosted
-
Server scripts written by an administrator on a site where server scripting was intentionally enabled, unless the framework's own sandboxing is what fails
Sorona
-
Third-party and custom apps installed on a site, which are other authors' code
Sorona
-
Upstream Python and JavaScript dependency issues, unless Frappe's own use of the dependency is what makes the defect reachable
Sorona
Recent changes
Reward and scope changes across every Frappe program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under frappe.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.