sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
L/ LLVM / Clang Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	2 days promised	Open

• L/

  LLVM / Clang

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  2 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://llvm.org

  Web

• Anything in the project running with more privilege than the person who invoked it, or crossing a privilege boundary the caller expected to hold

  Products and areas

• Clang itself where a defect reaches past compile time into the produced binary rather than stopping at a crash

  Products and areas

• Code generation across every back end and every target, where the emitted binary is more exploitable than the source called for

  Products and areas

• compiler-rt in full: the runtime support the compiler links into finished programs, which is the surface the policy actively points reporters at

  Products and areas

• libc++ and libc++abi, standard library code running inside a very large share of shipped C++ software

  Products and areas

• lld, the linker, covered by this entry and the default on Android. A linker creates output, so it sits on the stronger side of the tools distinction that runs through this whole category

  Products and areas

• lldb and the debug information it consumes

  Products and areas

• MLIR and Flang, both part of the same tree and covered by the same process

  Products and areas

• The policy takes reports across the whole LLVM project through a dedicated advisory repository, then narrows on what counts. Its own framing is that most miscompilations are ordinary bugs, and that one qualifies when there are clear indications the produced binary becomes significantly easier to exploit

  Products and areas

No target matches. Try part of a host name, such as the company name.