GDAL bug bounty programs

GDAL programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
GD GDAL Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• GD

  GDAL

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://gdal.org

  Web

• Every network-fetching path, covering HTTP range requests, cloud object-store access, credential handling and redirect following

  Products and areas

• SQL handling in the OGR SQL dialect and in the SQLite dialect that GeoPackage and Spatialite paths use

  Products and areas

• The algorithm and warping code, including reprojection, resampling, rasterisation and polygonisation

  Products and areas

• The command-line utilities the project ships, such as gdal_translate, gdalwarp, ogr2ogr and gdalinfo, and the newer unified gdal tool

  Products and areas

• The GDAL and OGR core: dataset and band abstractions, block caching, the RAT and metadata model, and the overview machinery

  Products and areas

• The published policy accepts security issues through the public issue tracker and draws no boundary narrower than the GDAL tree itself. Everything the library ships sits inside that

  Products and areas

• The Python, Java and C# bindings and the ownership and lifetime handling across those boundaries

  Products and areas

• The raster driver surface in full, all several hundred of them: GeoTIFF, NITF, JPEG2000, HDF4 and HDF5, NetCDF, PDF, PNG and JPEG, MrSID, ECW and every long-tail format nobody has looked at in years

  Products and areas

• The vector driver surface: shapefile, GeoPackage and the SQLite paths under it, GeoJSON, GML, KML, FileGDB, DXF, MapInfo and the rest of the OGR set

  Products and areas

• The virtual filesystem layer: /vsicurl/, /vsis3/, /vsizip/, /vsitar/, /vsigzip/, /vsimem/ and every other handler, including path parsing and the chained forms

  Products and areas

• The XML, JSON and WKT parsing that appears throughout the metadata, configuration and service-description paths

  Products and areas

No target matches. Try part of a host name, such as the company name.