Microsoft bug bounty programs

Microsoft programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
MS MsQuic Sorona · Bug bounty	$15k (highest)	–	–	–	$15,000	Partial	Required	–	Open
ME Monaco Editor Sorona · Bug bounty	$15k	–	–	–	$15,000	Partial	Required	–	Open

• MS

  MsQuic

  Sorona · Bug bounty

  Open

  Top reward

  $15k

  Critical

  $15k (highest)

  High

  –

  Medium

  –

  Low

  –

  Safe harbor

  Partial

  KYC

  Required

• ME

  Monaco Editor

  Sorona · Bug bounty

  Open

  Top reward

  $15k

  Critical

  $15k

  High

  –

  Medium

  –

  Low

  –

  Safe harbor

  Partial

  KYC

  Required

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://microsoft.github.io/monaco-editor

  Web

  Covered by Monaco Editor

• https://microsoft.github.io/msquic

  Web

  Covered by MsQuic

• Language configuration, tokenisation and Monarch grammar handling, plus the JSON, CSS, HTML and TypeScript worker services Microsoft ships alongside the editor

  Products and areas

  Covered by Monaco Editor

• Loss recovery, congestion control, and flow-control and stream-limit accounting

  Products and areas

  Covered by MsQuic

• Packet parsing, header protection and AEAD decryption paths, all of which run on bytes from an unauthenticated peer

  Products and areas

  Covered by MsQuic

• Stream multiplexing, stream state and reset handling, and the datagram extension

  Products and areas

  Covered by MsQuic

• The editor core: the text model, the view layer, and everything the editor puts into the host page's DOM

  Products and areas

  Covered by Monaco Editor

• The platform abstraction layer: the Windows, Linux and macOS datapaths, the kernel-mode driver, and the UDP socket and receive paths

  Products and areas

  Covered by MsQuic

• The public editor API and everything it exposes to an embedding application: options, commands, actions, keybindings and contribution points

  Products and areas

  Covered by Monaco Editor

• The public MsQuic API, the HTTP/3 framing surface it exposes to consumers, and the repository's own release GitHub Actions workflows

  Products and areas

  Covered by MsQuic

• The published monaco-editor npm package, its ESM and AMD builds, and the GitHub Actions workflows that release them

  Products and areas

  Covered by Monaco Editor

• The QUIC transport state machine: connection establishment, version negotiation, connection ID handling and migration

  Products and areas

  Covered by MsQuic

• The web worker boundary between the editor and its language services, and the protocol they speak across it

  Products and areas

  Covered by Monaco Editor

• The whole of microsoft/monaco-editor, which the program names on its SCOPE list as "Monaco-editor", at Critical or Important severity on the most recent actively maintained branch, with local-machine-only impact payable because Microsoft names Monaco in the carve-out

  Products and areas

  Covered by Monaco Editor

• The whole of microsoft/msquic, which the program names on its SCOPE list as "Msquic", at Critical or Important severity on the most recent actively maintained branch, provided the finding is remotely reachable

  Products and areas

  Covered by MsQuic

• The widget layer, hover, completion, signature help, code lens, inline suggestion and peek, together with the markdown rendered inside any of them

  Products and areas

  Covered by Monaco Editor

• TLS 1.3 handshake integration across both the schannel and OpenSSL back ends, including certificate validation and session resumption

  Products and areas

  Covered by MsQuic

No target matches. Try part of a host name, such as the company name.