GraalVM Community Edition bug bounty programs

GraalVM Community Edition programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
GC GraalVM CE Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• GC

  GraalVM CE

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.graalvm.org

  Web

• Espresso, the Java-on-Truffle implementation, and the language runtimes shipped with the distribution

  Products and areas

• JNI, the C API and the foreign-function paths where native code and managed code meet

  Products and areas

• Native Image and the AOT compilation pipeline, including reachability analysis, reflection configuration and the substitution mechanism

  Products and areas

• Oracle's vulnerability reporting process takes reports on any Oracle product by email to its security alerts address, and oracle/graal's SECURITY.md routes GraalVM there without declaring a narrower scope. One stated limit shapes everything below: the project says it does not currently support the execution of untrusted or adversarial code, so frame impact against a trusted-code threat model

  Products and areas

• The build tooling: native-image itself, the tracing agent that records reflection configuration, and the Maven and Gradle plugins that drive them

  Products and areas

• The Graal JIT compiler and every optimisation in it, where a miscompilation can drop a bounds check or a type check the source required

  Products and areas

• The gu component installer and anything else in the distribution that fetches and installs code

  Products and areas

• The native-image runtime and the image heap, which is populated at build time and mapped into every process the binary starts

  Products and areas

• The polyglot API and the context, resource-limit and sandbox options an embedder configures

  Products and areas

• The Substrate VM: its garbage collector, its threading and its isolate boundary

  Products and areas

• The Truffle language framework and its interoperability layer, where values cross between guest languages

  Products and areas

No target matches. Try part of a host name, such as the company name.