Nitro bug bounty programs

Nitro programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
NI Nitro Sorona · Bug bounty	–	$6,000	$1,250	$625	$6,000	Partial	–	24 hours promised	Open

• NI

  Nitro

  Sorona · Bug bounty

  Open

  Top reward

  $6,000

  Critical

  –

  High

  $6,000

  Medium

  $1,250

  Low

  $625

  Safe harbor

  Partial

  First response

  24 hours promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://nitro.build

  Web

• Caching: cached event handlers and cached functions, the keys they derive and the entries they write

  Products and areas

• Public and server asset serving out of the compiled bundle

  Products and areas

• Route rules in full, covering basicAuth, proxy, redirect, cache and header rules, and the order in which several of them compose on one request

  Products and areas

• Server middleware and the global middleware chain, including how it applies to WebSocket upgrades and to request paths that do not look like ordinary routes

  Products and areas

• The build and prerender pipeline that writes the compiled server bundle and rendered output into the workspace

  Products and areas

• The h3 request pipeline Nitro is built on: routing, event handling, body parsing, header handling and response writing

  Products and areas

• The hosting presets that compile that bundle for Node, Deno, Bun, Cloudflare Workers, Vercel, Netlify and AWS Lambda, where a preset's own request adaptation can diverge from the reference server

  Products and areas

• The nitrojs/nitro repository itself, added to the program on 2026-01-28 and listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. The asset is the repo, so Nitro's own server code is the target

  Products and areas

• The proxy layer, proxyRequest and sendProxy included, along with the header, cookie and redirect handling they perform in both directions

  Products and areas

• The storage layer and its drivers, where server state, cache entries and secrets are read and written

  Products and areas

No target matches. Try part of a host name, such as the company name.