sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
GC GCC Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
GG GNU gzip Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open
GB GNU Binutils Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• GC

  GCC

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• GG

  GNU gzip

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

• GB

  GNU Binutils

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://gcc.gnu.org

  Web

  Covered by GCC

• https://www.gnu.org/software/binutils

  Web

  Covered by GNU Binutils

• https://www.gnu.org/software/gzip

  Web

  Covered by GNU gzip

• ar and archive-member handling, directly relevant because a .deb is an ar archive and every Debian install unpacks one

  Products and areas

  Covered by GNU Binutils

• Code generation across every back end and every target, where the emitted binary dereferences an invalid pointer, reads or writes the wrong address, or crashes because the codegen was wrong

  Products and areas

  Covered by GCC

• Command-line handling and filesystem behaviour: the suffix logic, recursive mode, the output path gzip derives from an input name, and permission and ownership handling on the file it writes

  Products and areas

  Covered by GNU gzip

• GCC's SECURITY.txt draws the line in one place: a defect in the compiler itself is a security issue only when it generates vulnerable application code from conforming source the developer trusted. The runtime libraries GCC ships into finished binaries are evaluated separately, on their own security impact

  Products and areas

  Covered by GCC

• gzexe and the self-extracting shell scripts it generates

  Products and areas

  Covered by GNU gzip

• gzip header parsing in full: the stored filename field, the comment field, the extra fields and the flags that say which are present

  Products and areas

  Covered by GNU gzip

• libiberty and the other support code linked into GCC and into consumers well beyond the GCC tree

  Products and areas

  Covered by GCC

• libstdc++ in particular, since it is linked into a very large share of C++ software and runs on whatever data those programs receive

  Products and areas

  Covered by GCC

• Performance regressions in generated code severe enough to constitute denial of service, an accepted class named in the policy

  Products and areas

  Covered by GCC

• The BFD library in full: the object-file parsers for ELF, PE/COFF, Mach-O and XCOFF together with the debug-info readers underneath them

  Products and areas

  Covered by GNU Binutils

• The binary-inspection tools as a set. objdump, readelf, nm, strings and addr2line parse attacker-supplied binaries, which is exactly what malware triage and CI artifact inspection do all day

  Products and areas

  Covered by GNU Binutils

• The C, C++, Fortran, Ada, Go, D and Modula-2 front ends, to the extent a defect propagates into generated code rather than stopping at a compile-time failure

  Products and areas

  Covered by GCC

• The DEFLATE decompressor and compressor, the code path that runs on effectively every Linux system

  Products and areas

  Covered by GNU gzip

• The ld linker and everything it consumes: hostile object files, linker scripts, archive members, where the input is chosen by whoever supplied the dependency

  Products and areas

  Covered by GNU Binutils

• The legacy decoders compiled into every build: LZH, pack and compress, along with the format detection that decides which of them handles a file

  Products and areas

  Covered by GNU gzip

• The object-transformation tools that CI pipelines apply to build outputs, including gprof, objcopy and strip, running unattended on artifacts a build may not fully control

  Products and areas

  Covered by GNU Binutils

• The optimisation passes, where a transformation applied to conforming source produces a binary with a memory-safety defect the source did not have

  Products and areas

  Covered by GCC

• The shipped runtime libraries in full: libgcc, libstdc++, libgomp, libssp, libquadmath, libbacktrace and libatomic. All of these land inside production binaries and carry ordinary library risk

  Products and areas

  Covered by GCC

• The sourceware security process takes any reproducible security defect in Binutils itself. The only boundary it draws is the project line: GDB, GCC and LLVM are separate projects even where they share a repository, so what follows is the whole Binutils tree

  Products and areas

  Covered by GNU Binutils

• The trailer, including CRC and size checking and what gzip does when they disagree

  Products and areas

  Covered by GNU gzip

• The zgrep, zless, zdiff, zmore, zcat and zforce wrapper scripts shipped with gzip, which take filenames from the caller and hand them to other tools

  Products and areas

  Covered by GNU gzip

• There is no gzip-specific security policy. The GNU-wide policy is the only written guidance and it accepts a private report by email to the maintainers, with [email protected] as a fallback. Nothing narrower than the gzip tree is carved out, because nothing is carved out at all

  Products and areas

  Covered by GNU gzip

No target matches. Try part of a host name, such as the company name.