Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

isc.org Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • BIND 9

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 5 excluded.

  • https://www.isc.org/bind

    Web

  • DNSSEC end to end, covering validation, signing and key handling, including the algorithmic-complexity surface a signed but hostile zone can drive

    Products and areas

  • Every transport named accepts, from UDP and TCP through the DoT and DoH termination added in BIND 9.18 and later, and the network-manager rewrite underneath them that handles connection state

    Products and areas

  • ISC runs a confidential report channel at [email protected] for defects in named and the rest of the open-source BIND 9 tree. An operator's configuration choice is not a defect, ISC's commercial tooling and its separate Stork and Kea projects sit outside, and everything below sits inside

    Products and areas

  • The authoritative side in full: zone loading, AXFR and IXFR transfer parsing, notify handling, and the dynamic-update and DDNS path, all of which accept structured data from a peer

    Products and areas

  • The catalog-zones implementation and dnssec-policy key management, where one zone's contents drive another server's configuration

    Products and areas

  • The resolver in full: recursion, the cache and its fill logic, and the aggressive-NSEC and synthesised-answer paths where BIND answers from something it derived rather than something it was told

    Products and areas

  • The tools shipped alongside named in the same tree, since the boundary ISC draws is the open-source server rather than one binary

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Configuration errors: an open resolver by choice, a missing ACL, or a permissive allow-transfer, all of which are operator decisions rather than defects

  • Denial of service produced by raw query volume rather than by an algorithmic defect in how named handles a particular input

  • ISC's commercial subscription tooling and the BIND Support portal, which are not the open-source server

  • One-line patches that fix non-exploitable crashes, including crashes that only amount to resource exhaustion, which the Patch Rewards rules say will not generally be rewarded

  • Stork, ISC's monitoring dashboard, and Kea, its DHCP server, both separate projects with their own scope

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under isc.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.