Harbor bug bounty programs

Harbor programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
HA Harbor Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	3 days promised	Open

• HA

  Harbor

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://goharbor.io

  Web

• Authentication across the local database, LDAP and Active Directory, and OIDC, plus session handling and the CLI secret

  Products and areas

• Content trust and signature verification, covering Notary and Cosign, and the deployment security policy that enforces it

  Products and areas

• Proxy cache projects, which pull through to an upstream registry on a request from a client

  Products and areas

• Replication rules and every registry adapter, including Docker Hub, Quay, ECR, GCR, ACR, Artifactory and Harbor-to-Harbor

  Products and areas

• Robot accounts: their creation, the scopes attached to them, token issuance and how those tokens are checked on each request

  Products and areas

• SECURITY.md asks for private reports to [email protected] and declares no boundary narrower than Harbor itself. Everything below sits inside that

  Products and areas

• Tag retention rules, immutability rules and the garbage collection that acts on them

  Products and areas

• The core API in full and the whole registry surface it fronts, including the paths the portal does not use

  Products and areas

• The job service and its API, the quota accounting, and the database and Redis interactions behind all of it

  Products and areas

• The OCI distribution API paths, manifest and index handling, layer upload and download, and how Harbor proxies these to the storage backend

  Products and areas

• The portal UI and every place it renders repository, tag, description or scan content

  Products and areas

• The preheat and peer-to-peer distribution integration

  Products and areas

• The project and role model end to end, covering limited guest, guest, developer, maintainer, project admin and system admin, and every operation each may perform

  Products and areas

• The vulnerability scanner integration, the scan job flow and the report storage behind it

  Products and areas

• Webhooks and every other outbound request Harbor makes to an operator-supplied URL

  Products and areas

No target matches. Try part of a host name, such as the company name.