Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Gradle Inc. bug bounty programs

gradle.org Updated

Gradle Inc. runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Gradle Inc. runs.

  • Gradle

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 6 excluded.

  • https://gradle.org

    Web

  • Build script compilation and evaluation for both the Groovy and Kotlin DSLs, plus init scripts, included builds and buildSrc

    Products and areas

  • Credential handling for repository authentication, together with anything that lands a secret in build output, a log or a build scan

    Products and areas

  • Dependency resolution and artefact download from Maven and Ivy repositories, including repository metadata handling, redirects and mirror behaviour

    Products and areas

  • Java toolchain provisioning, where Gradle downloads and installs a JDK on demand

    Products and areas

  • Plugin resolution from the Gradle Plugin Portal and the plugin marker mechanism behind it

    Products and areas

  • The build cache, local and remote, covering cache key derivation, entry packing and unpacking, and anything that lets one build's output be served to another build

    Products and areas

  • The configuration cache and the serialised state it stores and later replays

    Products and areas

  • The dependency verification subsystem in full: checksum and signature checking, the verification metadata file, key server lookups and trusted-key handling

    Products and areas

  • The Gradle daemon and everything reachable across its client connection, including the Tooling API that IDEs drive it through

    Products and areas

  • The Gradle wrapper: the checked-in wrapper JAR, the distribution download and the checksum verification meant to make that download safe

    Products and areas

  • The policy declares a wide scope in writing: the Gradle Build Tool, Develocity, the Build Cache node Docker image, the official plugins, and any non-example, non-archived repository in the Gradle GitHub org, along with the gradle.org, gradle.com and grdev.net domains. Third-party dependencies count too where you can show the impact on Gradle's own use of them. Reports go to [email protected]

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A build executing code the build script legitimately asked it to execute, which is the entire job of a build tool

  • Maven Central, the Plugin Portal and other registries as services, as opposed to Gradle's handling of what they return

  • Reports filed on the HackerOne directory listing, which is an external entry with no live program behind it

  • The Android Gradle Plugin, which is Google's code and goes through Google's process

  • The JVM and the JDK themselves, which have their own vendors and their own reporting paths

  • Third-party plugins published to the Plugin Portal, which belong to their authors; a plugin behaving badly is an ecosystem problem rather than a Gradle defect

Recent changes

Reward and scope changes across every Gradle Inc. program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Gradle Inc. products, from the NVD.

Search NVD
  • CVE-2026-25063 High

    gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gradle-completion up to and including 9.3.0 that allows arbitrary code execution when a user triggers Bash tab completion in a project containing a malicious Gradle build file. The `gradle-completion` script for Bash fails to adequately sanitize Gradle task names and task descripti

  • CVE-2026-22816 High

    Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies fr

  • CVE-2026-22865 High

    Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies fr

  • CVE-2023-49238 Critical

    In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.

  • CVE-2023-42445 Medium

    Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle pa

  • CVE-2023-44387 Low

    Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While i

  • CVE-2023-35946 Medium

    Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency coordinates, Gradle can be made to write files into an unintended location. The file may be written outside the dependency cache or over anoth

  • CVE-2023-35947 Medium

    Gradle is a build tool with a focus on build automation and support for multi-language development. In affected versions when unpacking Tar archives, Gradle did not check that files could be written outside of the unpack location. This could lead to important files being overwritten anywhere the Gradle process has write permissions. For a build reading Tar entries from a Tar archive, this issue co

About this page

This page gathers every public program listed under gradle.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.