Where to report
The one public program Go runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Go
Sorona · Bug bounty |
$7,500 | Partial | – | 7 days promised | Open |
-
- Safe harbor
- Partial
- First response
- 7 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 6 excluded.
-
https://go.dev
Web
-
Cryptographic weaknesses such as practical key recovery, constant-time failures, or signature and certificate-validation bypass in crypto/tls and crypto/x509
Products and areas
-
Defects in the Go toolchain itself: the gc compiler, the linker and assembler, the go command, and go vet
Products and areas
-
Leaked credentials, sensitive write-access keys, or insecure configuration in Go's own repositories, which the OSS VRP treats as a standing top priority
Products and areas
-
Parser and resource-handling flaws reachable through importable packages: algorithmic-complexity or decompression-bomb denial of service, stack exhaustion from recursive parsing, XSS in html/template, and argument or PATH injection via os/exec
Products and areas
-
Path-traversal and filepath-handling flaws, including Windows-specific behavior in path/filepath
Products and areas
-
Security bugs in the Go standard library that break a documented security property, spanning crypto/*, encoding/*, net/http, path/filepath, os/exec, syscall, archive/*, and the rest of the stdlib, reported to the Go security team
Products and areas
-
Supply-chain exposure across Go project infrastructure: the module proxy (proxy.golang.org), the checksum database (sum.golang.org), the vulnerability database tooling (vuln.go.dev), and Go's build and release infrastructure
Products and areas
-
Vulnerabilities in the golang.org/x/... sub-repositories that are part of the Go project (for example x/crypto, x/net, x/text, x/tools)
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Automated scanner or fuzzer output submitted without triage, a reproducer, or root-cause analysis
-
Bugs that are not actually present in a Go package (misattributed user-code issues)
-
Denial-of-service or panics with no security-relevant impact beyond a crash, and issues that only affect Go releases already fixed in the two most recent major versions
-
Findings already subsumed by an entry in the Go vulnerability database, or documented as expected behavior in Go's published vulnerability-classification decisions
-
Third-party or non-Go-project code; report those upstream first
-
Vulnerabilities in Go applications or non-importable code, including anything in package main or an installable command, which sit outside the Go vulnerability database's scope
Recent changes
Reward and scope changes across every Go program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under go.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.