Helm bug bounty programs

Helm programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
HE Helm Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	3 days promised	Open

• HE

  Helm

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://helm.sh

  Web

• Chart dependency resolution, the repository client, the index file it fetches and the lock file it writes

  Products and areas

• Chart hooks, their ordering and the resources they create outside the normal release

  Products and areas

• kubeconfig handling, the credentials Helm uses to talk to the cluster and the post-renderer hook that pipes manifests through an external command

  Products and areas

• OCI registry support end to end, covering pull, push, authentication, credential storage and the manifest handling in between

  Products and areas

• Provenance and signature verification: provenance files, the PGP path and helm verify

  Products and areas

• Release storage in Secrets or ConfigMaps, including what is written there and who in the namespace can read it

  Products and areas

• The chart loader and archive handling, covering tar extraction, entry names, symlinks and everything a .tgz can express about where a file should land

  Products and areas

• The Go template rendering engine as Helm configures it, and the whole sprig function set exposed to chart authors

  Products and areas

• The Helm Go SDK, which GitOps controllers embed rather than shelling out to the binary

  Products and areas

• The plugin system, plugin installation from a URL or a repository, and what an installed plugin can run

  Products and areas

• The published process asks for private reports to [email protected] and declares no boundary narrower than the Helm codebase. Everything below sits inside that

  Products and areas

• The release lifecycle commands, install, upgrade, rollback and uninstall, and the manifests each applies

  Products and areas

• Values handling: the merge order across files, --set, --set-string, --set-file and --set-json, and the parser behind each

  Products and areas

No target matches. Try part of a host name, such as the company name.