MediaWiki bug bounty programs

MediaWiki programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
ME MediaWiki Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• ME

  MediaWiki

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.mediawiki.org

  Web

• AuthManager and the authentication stack, covering login, sessions, password reset, two-factor handling, OAuth and shared-login setups

  Products and areas

• File upload and thumbnail generation, which run parsers and external converters over content an untrusted user supplied

  Products and areas

• Page protection, revision deletion and oversight, the mechanisms that hide content from users who are otherwise trusted

  Products and areas

• ResourceLoader and the JavaScript and CSS delivery path, including site-wide and user-specific scripts

  Products and areas

• Special pages, the search interface and the job queue, along with the maintenance scripts that run with shell context

  Products and areas

• The action API at api.php and the REST API, both of which expose the same operations as the web interface through a different code path

  Products and areas

• The extension and hook interface, plus the extensions bundled with a release tarball

  Products and areas

• The installer and the update path, which run with more authority than the running wiki

  Products and areas

• The published reporting page asks for any software security bug in MediaWiki through the security address or a Security-flagged Phabricator task, and draws no boundary narrower than the software itself

  Products and areas

• The user rights and group permission system, covering every right a group can hold and every check that consults it

  Products and areas

• The wikitext parser and everything downstream of it, including templates, parser functions and the sanitisation applied before output reaches a browser

  Products and areas

No target matches. Try part of a host name, such as the company name.