Mailu bug bounty programs

Mailu programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
MA Mailu Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• MA

  Mailu

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://mailu.io

  Web

• Certificate handling and the ACME integration behind it

  Products and areas

• Fetchmail, forwarding, aliases and every other rule deciding where a message ends up

  Products and areas

• The admin front end in full: authentication, session handling, and every page an administrator, a domain manager or a mailbox user can reach

  Products and areas

• The API, including token issuance, token management and every endpoint sitting behind them

  Products and areas

• The authentication service the mail daemons call to check a credential, including the header-based proxy authentication path

  Products and areas

• The container set and its configuration: the compose definitions, the environment variables holding secrets, and the reverse proxy Mailu ships in front of everything

  Products and areas

• The multi-tenant model: domains, aliases, per-domain administrators, and the checks keeping one domain's configuration out of another's reach

  Products and areas

• The policy accepts severe security issues at a private address and sets no boundary on which part of Mailu they may be in. Everything Mailu itself writes or wires together is inside that

  Products and areas

• The setup utility that generates a deployment's configuration, since a defect there ships into every new installation

  Products and areas

• The webmail integration, covering the single sign-on handoff into Roundcube or SnappyMail and the session that lands on the other side

  Products and areas

No target matches. Try part of a host name, such as the company name.