sorona.xyz bug bounty programs
kde.org Updated
Sorona.xyz runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 16
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
KDE Plasma core
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
KDE Plasma core
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
KDE
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
16 targets across all 2 programs, each listed once with the programs that cover it. 7 excluded.
-
Input handling through KWin: keyboard grabs, global shortcut dispatch, pointer and touch routing, and the special-key path that reaches the shell before applications
Products and areas
Covered by Sorona
-
KIO in full: URL parsing, protocol dispatch and every KIO worker, including the file, http, sftp, smb, fish, tar, archive and trash handlers
Products and areas
Covered by Sorona
-
KRunner and the search and launcher path, where typed text becomes a command
Products and areas
Covered by Sorona
-
KWin as a Wayland compositor: protocol object handling, surface and buffer lifetimes, the protocol extensions it implements and the effect and scripting system
Products and areas
Covered by Sorona
-
KWin as an X11 window manager, including window property handling, selections and the client boundary
Products and areas
Covered by Sorona
-
Notifications, clipboard handling through Klipper, and drag-and-drop as the desktop arbitrates them between clients
Products and areas
Covered by Sorona
-
plasma-workspace's shell, panel, widget and applet machinery, including how a widget from the store is installed and what privileges it receives
Products and areas
Covered by Sorona
-
Screen capture, screencast and remote-desktop interfaces and the portal-facing surface behind them
Products and areas
Covered by Sorona
-
Session management, autostart handling and the D-Bus interfaces these components expose
Products and areas
Covered by Sorona
-
The KDE Security Policy publishes a contact and a process rather than a component list, so the boundary is KDE's own code. Everything below sits inside it and nothing narrower is carved out
Products and areas
Covered by Sorona
-
The KIO worker execution model itself, covering how a worker is launched, what it inherits and what a malicious URL can steer it into
Products and areas
Covered by Sorona
-
The lock screen in plasma-workspace end to end: the greeter, the unlock authentication path, what remains visible or reachable while locked and every transition into or out of the locked state
Products and areas
Covered by Sorona
-
The system settings modules and the KAuth helper mechanism, where an unprivileged action is handed to a privileged helper
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 7
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Attacks requiring the attacker to already run code as the logged-in user, unless the finding crosses out of that user's boundary
Sorona
-
Configuration choices an administrator or user made deliberately
Sorona
-
Distribution and vendor patches, including SteamOS's own changes, rather than upstream KDE
Sorona
-
KDE applications outside the Plasma core trees, unless the defect is in KWin, plasma-workspace or KIO
Sorona
-
Qt itself, which is a separate project with its own security process and its own entry
Sorona
-
software used but not produced by KDE (e.g. gitlab, bugzilla, etc.)
Self-hosted
-
Third-party Plasma widgets, KWin scripts and global themes from the store, which are not KDE code. A widget that grants itself privilege is that widget's defect
Sorona
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under kde.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.