sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
GH Ghostscript Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
GH Ghostscript Self-hosted · Bug bounty	–	–	–	–	Not published	None	–	–	Open

• GH

  Ghostscript

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• GH

  Ghostscript

  Self-hosted · Bug bounty

  Open

  Top reward

  Not published

  Safe harbor

  None

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://ghostscript.com

  Web

  Covered by Sorona

• Reports go through the contact in the project's SECURITY.md, and what is covered is the Ghostscript tree itself, reachable however a downstream caller feeds it. Nothing narrower is carved out

  Products and areas

  Covered by Sorona

• The -dSAFER sandbox and every restriction it is supposed to impose, since SAFER is the guarantee every downstream integrator relies on when it feeds Ghostscript an untrusted file

  Products and areas

  Covered by Sorona

• The command-line front end and the options, resource paths and initialisation files it accepts, which is what downstream delegate invocations such as ImageMagick's are built on

  Products and areas

  Covered by Sorona

• The glue around the bundled jbig2dec, JPEG and lcms decoders, where Ghostscript hands attacker-controlled data across a library boundary

  Products and areas

  Covered by Sorona

• The graphics library and the whole of devices/, covering the raster, printer and display back ends that turn interpreted content into output

  Products and areas

  Covered by Sorona

• The gs_* font and CMap machinery, where malformed embedded fonts and character mappings are parsed

  Products and areas

  Covered by Sorona

• The PDF interpreter under pdf/, rewritten in C for the Ghostscript 10.x series and therefore comparatively fresh, less-exercised code

  Products and areas

  Covered by Sorona

• The PostScript interpreter in full: the language implementation, the operator table, and the place where attacker-written program text is executed directly

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.