sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
LI libgcrypt Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• LI

  libgcrypt

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://gnupg.org/software/libgcrypt

  Web

• Key derivation and password-based key derivation, including the parameter handling that decides the real cost of a crack

  Products and areas

• The GnuPG security page asks for severe security problems by private mail and publishes an explicit threat model for libgcrypt. Beyond the side channel carve-out in that model, it draws no boundary narrower than the library itself

  Products and areas

• The hand-written assembly selected per CPU feature, along with the portable C fallback that runs where no accelerated path exists

  Products and areas

• The hash and MAC families, covering the SHA and BLAKE algorithms and the HMAC and CMAC constructions built on them

  Products and areas

• The multi-precision integer layer, which is the arithmetic every asymmetric operation runs through and the place a carry or reduction defect becomes a key recovery

  Products and areas

• The public key implementations: RSA, DSA, the elliptic curve algorithms, and the key generation and parameter checking around each

  Products and areas

• The random number generator, its entropy gathering, its reseeding and its behaviour in the early boot and container cases where entropy is scarce

  Products and areas

• The S-expression parser and the public API surface, which handles structured input supplied by the calling application

  Products and areas

• The secure memory subsystem, covering locked pages, the allocator and the wiping guarantees the library advertises

  Products and areas

• The self-test and FIPS mode machinery, where a test that passes over a broken implementation is itself the defect

  Products and areas

• The symmetric ciphers and their modes, including the AEAD constructions and their tag verification paths

  Products and areas

No target matches. Try part of a host name, such as the company name.