Home Assistant bug bounty programs

Home Assistant programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
HA Home Assistant Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
HA Home Assistant Self-hosted · Disclosure only	–	–	–	–	No cash	–	–	7 days promised	Open

• HA

  Home Assistant

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• HA

  Home Assistant

  Self-hosted · Disclosure only

  Open

  Top reward

  No cash

  First response

  7 days promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.home-assistant.io

  Web

  Covered by Sorona

• Home Assistant for Android

  Android

  Covered by Self-hosted

• Home Assistant for iOS

  iOS

  Covered by Self-hosted

• Authentication end to end: the login flow, multi-factor providers, the trusted-networks provider, the long-lived access tokens that never expire and the refresh token machinery

  Products and areas

  Covered by Sorona

• Device discovery over mDNS, SSDP, DHCP and Bluetooth, all of which act on unauthenticated broadcast data from the local network

  Products and areas

  Covered by Sorona

• Home Assistant

  Products and areas

  Covered by Self-hosted

• Home Assistant Cloud and the Nabu Casa remote access path, plus the webhook endpoints reachable without a session

  Products and areas

  Covered by Sorona

• Home Assistant Core

  Products and areas

  Covered by Self-hosted

• Home Assistant Supervisor

  Products and areas

  Covered by Self-hosted

• Template rendering, scripts and automations, and any other path where configuration turns into execution on the host

  Products and areas

  Covered by Sorona

• The companion mobile apps, their deep-link handlers and the webview bridges where a page can reach the native layer

  Products and areas

  Covered by Sorona

• The custom-component loading path and the update and backup mechanisms that write to the host filesystem

  Products and areas

  Covered by Sorona

• The frontend, including cross-site scripting in dashboards, Lovelace cards and anything that renders a device-supplied string

  Products and areas

  Covered by Sorona

• The integration framework and every integration shipped in the tree, covering both credential storage and whatever each one parses from a device or a cloud service

  Products and areas

  Covered by Sorona

• The published policy accepts security vulnerabilities across Home Assistant and states its CVE criteria rather than a narrow asset list, so the whole platform is the declared target: Core, Supervisor, the Operating System, the frontend, the add-on system and the companion apps

  Products and areas

  Covered by Sorona

• The Supervisor and the add-on system: add-on installation, the store, the host network mode that exposes add-on ports to the LAN, and the API a container uses to call back into the Supervisor

  Products and areas

  Covered by Sorona

• The user and permission model, including what separates an administrator from an ordinary user and what a non-admin account can reach

  Products and areas

  Covered by Sorona

• The websocket and REST APIs, covering every command an authenticated session can issue and the authorisation checks in front of them

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.