Ledger bug bounty programs
ledger.com Updated
Ledger runs two public programs: a self-hosted bug bounty and a Sorona bug bounty.
- Top reward
- Not published
- Programs
- 2
- 2 pay cash
- Targets in scope
- 26
- 6 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Ledger DonJon
Self-hosted
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Ledger DonJon
Self-hosted · Bug bounty |
Not published | Partial | – | 24 hours promised | Open |
|
Ledger (embedded apps and Ledger Wallet)
Sorona · Bug bounty |
Not published | Partial | – | 24 hours promised | Open |
-
- Safe harbor
- Partial
- First response
- 24 hours promised
-
- Safe harbor
- Partial
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
26 targets across all 2 programs, each listed once with the programs that cover it. 22 excluded.
-
Hardware attacks on the Ledger devices (i.e. hardware products)
Hardware and IoT
Covered by Self-hosted
-
Device firmware and the devices themselves: software attacks on firmware and hardware attacks on the product are both named in the Devices scope
Products and areas
Covered by Sorona
-
Each app's whole surface, which is APDU command handling, transaction parsing and the clear-signing display logic, the confirmation flow, and the key derivation and SDK use underneath all of it
Products and areas
Covered by Sorona
-
Ledger Wallet desktop and mobile, where Ledger asks for anything leading to loss of user funds, compromise of sensitive data or bypass of security controls: unauthorised transaction crafting, signing bypass, USB or BLE channel compromise, remote code execution, update-mechanism supply-chain attacks, genuine-device-check bypass and dApp sandbox escape
Products and areas
Covered by Sorona
-
Ledger's own line covers three scopes: "Ledger Bug Bounty Program covers our hardware devices, Ledger Wallet applications, as well as our web services." The open-source half of that is the embedded coin apps and the ledger-live monorepo behind Ledger Wallet
Products and areas
Covered by Sorona
-
Private data leakage from Ledger Wallet, named specifically as accounts, balances and xpubs
Products and areas
Covered by Sorona
-
The device impacts Ledger names: PIN bypass, arbitrary code execution on the secure element or MCU, privilege escalation out of an app, bypass of the user's transaction confirmation, and sensitive memory leaks
Products and areas
Covered by Sorona
-
The enumerated embedded apps, all Apache-2.0 under github.com/LedgerHQ, in the versions distributed through Ledger Wallet: app-bitcoin, app-bitcoin-new, app-ethereum, app-solana, app-xrp, app-monero, app-cardano, app-stellar, app-sui, app-tron, app-exchange, app-openpgp, app-security-key and app-recovery-check, with app-hyperliquid listed as coming soon
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 22
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anyone resident in, or submitting from, a country against which France has issued export sanctions, who is disqualified from the program whatever the finding
Sorona
-
Attacks requiring prior local access to the computer or mobile device (e.g. malware already installed, physical access to an unlocked machine)
Self-hosted
-
Attacks that require pre-existing local access, installed malware, or physical access to an already-unlocked machine or device
Sorona
-
Broken links
Self-hosted
-
Denial of service against Ledger Wallet (app crashes without security impact)
Self-hosted
-
Denial of service against Ledger Wallet with no security impact, and dependency staleness without a demonstrated exploit
Sorona
-
Display discrepancies in Ledger Wallet where the device screen is correct, since the device screen is the trust anchor and the desktop display is not
Sorona
-
Editable Github wikis
Self-hosted
-
Model-generated findings, which an explicit anti-AI clause bars under a permanent-ban provision
Sorona
-
Outdated dependencies without a demonstrated exploitable vulnerability
Self-hosted
-
Outdated software without any noteworthy vulnerability
Self-hosted
-
Reports from automated scanners without manual verification (see AI-generated reports policy)
Self-hosted
-
Reports from automated tools or scans
Self-hosted
-
Reports of insecure SSL/TLS ciphers (unless you have a working proof of concept)
Self-hosted
-
Self-XSS or issues requiring unlikely user interaction chains
Self-hosted
-
The usual web non-issues: SPF and DMARC records, missing CSRF tokens, clickjacking, missing headers, scanner output, weak TLS ciphers without a proof of concept, and absent rate limiting
Sorona
-
Theoretical vulnerabilities with no working device-level proof of concept
Sorona
-
Theoretical vulnerabilities without a working proof-of-concept demonstrating actual exploitation on the device
Self-hosted
-
Third-party dApp bugs that do not affect Ledger Wallet beyond the dApp's own scope
Sorona
-
UI/UX bugs with no security impact (cosmetic glitches, typos, layout issues)
Self-hosted
-
Vulnerabilities in third-party dApps themselves that do not impact Ledger Wallet or its users beyond the dApp's own scope
Self-hosted
-
Vulnerabilities requiring physical access to an already-unlocked Ledger device
Self-hosted
Recent changes
Reward and scope changes across every Ledger program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under ledger.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.