sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
NA NATS Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• NA

  NATS

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://nats.io

  Web

• Authentication across tokens, username and password, NKeys, JWT-based users and mutual TLS, plus the certificate-to-identity mapping

  Products and areas

• Cluster routes, gateways, leafnodes and superclusters, and the trust each establishes between servers

  Products and areas

• JetStream end to end: streams, consumers, the key-value and object stores, the JetStream API subjects and the permission checks on each

  Products and areas

• Queue groups, subject mapping, subject transforms and the wildcard matching behind all of them

  Products and areas

• The accounts model in full: subject-level publish and subscribe permissions, allow and deny lists, response permissions, and imports and exports between accounts

  Products and areas

• The advisory policy asks for private reports at [email protected] with GitHub Security Advisories used for publication, and declares no boundary narrower than the NATS server

  Products and areas

• The client protocol parser, the connection handshake and everything the server accepts before a client is authenticated

  Products and areas

• The embedded server library that other Go programs link and run in-process

  Products and areas

• The monitoring HTTP endpoints and what an unauthenticated caller can read from them

  Products and areas

• The MQTT and WebSocket gateways the server implements, each with its own protocol handling and its own authentication mapping

  Products and areas

• The operator and account JWT chain, the account resolver that fetches JWTs, signature verification on them and the revocation lists they carry

  Products and areas

• The system account and the $SYS subjects that expose server, connection and client state

  Products and areas

• TLS configuration on every listener, including certificate verification and the handshake with peer servers

  Products and areas

No target matches. Try part of a host name, such as the company name.