Prow bug bounty programs

Prow programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
PR Prow Sorona · Bug bounty	$10k (highest)	$1,250	$250	$100	$10,000	Partial	–	24 hours promised	Open
MI Minikube Sorona · Bug bounty	–	$3,125 (highest)	$625 (highest)	$125 (highest)	$3,125	Partial	–	24 hours promised	Open
KO kOps Sorona · Bug bounty	–	$3,125	$625	$125	$3,125	Partial	–	24 hours promised	Open

• PR

  Prow

  Sorona · Bug bounty

  Open

  Top reward

  $10k

  Critical

  $10k (highest)

  High

  $1,250

  Medium

  $250

  Low

  $100

  Safe harbor

  Partial

  First response

  24 hours promised

• MI

  Minikube

  Sorona · Bug bounty

  Open

  Top reward

  $3,125

  Critical

  –

  High

  $3,125 (highest)

  Medium

  $625 (highest)

  Low

  $125 (highest)

  Safe harbor

  Partial

  First response

  24 hours promised

• KO

  kOps

  Sorona · Bug bounty

  Open

  Top reward

  $3,125

  Critical

  –

  High

  $3,125

  Medium

  $625

  Low

  $125

  Safe harbor

  Partial

  First response

  24 hours promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://docs.prow.k8s.io

  Web

  Covered by Prow

• https://kops.sigs.k8s.io

  Web

  Covered by kOps

• https://minikube.sigs.k8s.io

  Web

  Covered by Minikube

• Certificate, credential and kubeconfig handling on the developer's workstation

  Products and areas

  Covered by Minikube

• Configuration and credential handling: config.yaml and plugins.yaml loading, the ProwJob resource, GitHub token brokering through ghproxy, and the secrets a build cluster holds

  Products and areas

  Covered by Prow

• Host-to-guest networking: port forwarding, minikube tunnel and minikube mount, which push cluster services onto the workstation's network and host directories into the cluster

  Products and areas

  Covered by Minikube

• Node bootstrap: nodeup, kops-controller and the bootstrap token and node-authorizer path that decides what a joining machine is allowed to claim to be

  Products and areas

  Covered by kOps

• The addon system and the manifests it applies, including how Minikube stands up the Kubernetes Dashboard, registry, ingress and metrics-server

  Products and areas

  Covered by Minikube

• The cluster lifecycle commands and everything behind them: create, update, rolling-update and delete, along with the cluster spec API and the validation applied to it

  Products and areas

  Covered by kOps

• The command handlers a contributor can reach: /test, /retest, /ok-to-test, /lgtm, /approve and the OWNERS resolution underneath them

  Products and areas

  Covered by Prow

• The driver layer across Docker, Podman, KVM2, HyperKit, VirtualBox, QEMU and the rest, including how each one isolates the guest it creates from the host

  Products and areas

  Covered by Minikube

• The in-cluster components kOps ships and manages, including protokube, dns-controller, channels and the addon manifests they apply

  Products and areas

  Covered by kOps

• The ISO, the kicbase container image and the preload tarballs, along with the download and verification path that pulls Kubernetes binaries and images onto the workstation

  Products and areas

  Covered by Minikube

• The job lifecycle, meaning plank, sinker, crier, horologium and the pod utilities (clonerefs, initupload, entrypoint, sidecar) that check out and run untrusted pull-request code in the build cluster

  Products and areas

  Covered by Prow

• The kOps CLI itself, including kubeconfig export and the credentials it writes on the operator's workstation

  Products and areas

  Covered by kOps

• The kubernetes/kops repository, which the program lists as a bounty-eligible source-code asset up to critical severity under the instruction "Kubernetes Operations (kops) - Production Grade K8s Installation, Upgrades, and Management", priced at Tier 2: $100 at Low rising to $5,000 at Critical

  Products and areas

  Covered by kOps

• The kubernetes/minikube repository, which the program lists as a bounty-eligible source-code asset up to critical severity under the instruction "Run Kubernetes locally", priced at Tier 2: $100 at Low rising to $5,000 at Critical

  Products and areas

  Covered by Minikube

• The minikube binary and its whole command surface: start, stop, delete, tunnel, mount, service, dashboard, ssh, cp, image and addons

  Products and areas

  Covered by Minikube

• The rest of kubernetes/test-infra, since the whole repository is the asset: the CI configuration for the Kubernetes project along with the release and artifact-publishing tooling it carries

  Products and areas

  Covered by Prow

• The state store, meaning the S3 or GCS bucket layout, the cluster spec kept there and the secrets and certificates alongside it, plus every path that reads or writes any of that

  Products and areas

  Covered by kOps

• The webhook ingress hook and the plugin set behind it, including the trust model that decides whose comment Prow will act on

  Products and areas

  Covered by Prow

• tide, which decides what actually merges into kubernetes/kubernetes, and deck, the web UI that serves job logs and artifacts at prow.k8s.io

  Products and areas

  Covered by Prow

• Two assets, both bounty-eligible up to critical severity: the kubernetes/test-infra repository, listed as "Test infrastructure for the Kubernetes project", and prow.k8s.io as a live URL asset carrying the instruction "Please limit automated scanning to 1qps". Prow prices as Tier 3 infrastructure, $100 to $2,500, promoted to Tier 1 and $10,000 where the compromise reaches code or artifact modification

  Products and areas

  Covered by Prow

• What kOps generates for the cloud account, covering IAM policies, instance profiles and security groups, and what it lays down in the cluster, covering control plane flags, etcd topology and certificate material

  Products and areas

  Covered by kOps

No target matches. Try part of a host name, such as the company name.