Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Keras bug bounty programs

keras.io Updated

Keras runs one public program: a Sorona bug bounty paying up to $3,100.

Top reward
$3,100
Sorona
Programs
1
1 pays cash
Targets in scope
10
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Keras runs.

  • Keras

    Sorona · Bug bounty

    Open

    Top reward

    $3,100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 9 excluded.

  • https://keras.io

    Web

  • Callbacks and the training loop, covering checkpoint writing, logging and the callbacks that reach the network during fit

    Products and areas

  • Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and it names both keras-team/keras and keras-team/tf-keras at TIER_OT1: a product vulnerability anywhere in either repository is accepted, at $101 to $3,133.70

    Products and areas

  • keras.saving end to end: config serialisation and deserialisation, custom-object registration and resolution, the safe_mode guard, and the layer graph rebuilt from a config the loader did not author

    Products and areas

  • keras.utils: get_file downloading and archive extraction, the dataset, image and text loading helpers, and the path handling around all of it

    Products and areas

  • Model persistence in every format the library reads or writes: the .keras archive, legacy HDF5 .h5 files, weights-only checkpoints, and the SavedModel export and import paths

    Products and areas

  • Multi-backend dispatch across the TensorFlow, JAX, PyTorch and NumPy backends, including anything reachable through only one of them

    Products and areas

  • Preprocessing and feature layers that parse user-supplied text, images or tabular values at run time rather than at model-build time

    Products and areas

  • Repository configuration and the PyPI release pipeline for keras and tf-keras, which Google prices under its separate supply-chain category

    Products and areas

  • The modelling API itself: keras.layers, keras.Model and the functional and sequential builders, keras.ops, activations, initialisers, constraints, losses, metrics and optimisers

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 9

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Adversarial-example, model-poisoning and other ML-robustness research, which the program routes to the Google AI VRP rather than the OSS VRP

  • Any other repository in the keras-team org, which the tier file does not list and which pays nothing for a product vulnerability after the April 2026 rules update

  • Application-level misuse of the saving API by the caller

  • Backend framework bugs that actually belong to TensorFlow, JAX or PyTorch rather than to Keras

  • Defects that only reproduce on a release the projects no longer ship, since the program covers the latest versions

  • Loading a model from an untrusted source with safe_mode=False, which the project documents as unsafe and places out of scope

  • Notebook and tutorial code shipped alongside the library

  • Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees

  • Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue

Recent changes

Reward and scope changes across every Keras program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Keras products, from the NVD.

Search NVD
  • CVE-2026-12482 Medium

    A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to syml

  • CVE-2026-12481 Critical

    A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic er

  • CVE-2026-11816 High

    Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is

  • CVE-2026-1462 High

    A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due

  • CVE-2026-1669 High

    Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.

  • CVE-2026-0897 High

    Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.

  • CVE-2025-9905 High

    The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the f

  • CVE-2025-9906 High

    The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization(

About this page

This page gathers every public program listed under keras.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.