Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Composer bug bounty programs

getcomposer.org Updated

Composer runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Composer runs.

  • Composer

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 6 excluded.

  • https://getcomposer.org

    Web

  • Archive download and extraction for zip and tar distributions, including path handling on unpack

    Products and areas

  • Credential and token handling in auth.json and COMPOSER_AUTH, plus the OAuth flows for GitHub, GitLab and Bitbucket

    Products and areas

  • Dependency resolution end to end: the solver, constraint handling and everything that decides which version of which package an install lands on

    Products and areas

  • Integrity and authenticity checking on downloaded artefacts, plus the composer.lock format and what a lock entry is taken to guarantee on a later install

    Products and areas

  • Package metadata handling, covering every field Composer reads out of a composer.json or out of a repository's JSON, whichever repository served it

    Products and areas

  • Script and plugin execution: scripts entries, composer-plugin packages and custom installers, all of which run with the privileges of the build

    Products and areas

  • The autoloader generator and everything it writes into vendor/

    Products and areas

  • The HTTP layer, TLS verification and proxy handling, and the self-update path with the signature checks on a replacement binary

    Products and areas

  • The published policy asks for anything with security implications to go privately to [email protected], and draws no line narrower than the Composer codebase itself

    Products and areas

  • The VCS drivers, including Git, Mercurial, Subversion, Fossil and Perforce, and every place a repository-supplied value reaches a process invocation

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Libraries Composer depends on, unless Composer's own use of one is what makes the defect reachable

  • Malicious packages published to Packagist, which is registry abuse rather than a defect in Composer

  • packagist.org as a service and Private Packagist as a product, unless the defect is in how Composer handles what they return

  • PHP the language and its interpreter, a separate project under separate governance with its own reporting path

  • Public reports: the policy asks explicitly for private reporting and treats anything else as a disclosure failure

  • Third-party Composer plugins that are not part of the composer/composer tree

Recent changes

Reward and scope changes across every Composer program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Composer products, from the NVD.

Search NVD
  • CVE-2026-40261 High

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-supplied

  • CVE-2026-40176 High

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious com

  • CVE-2025-67746 Low

    Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this h

  • CVE-2024-24821 High

    Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked with

  • CVE-2023-43655 Medium

    Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should ma

  • CVE-2015-8371 High

    Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus c

  • CVE-2022-24828 High

    Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercu

  • CVE-2021-41116 High

    Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

About this page

This page gathers every public program listed under getcomposer.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.