NocoDB bug bounty programs

NocoDB programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
NO NocoDB Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• NO

  NocoDB

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://nocodb.com

  Web

• Authentication end to end: password login, invitation flow, session issuance, single sign-on and any OAuth or SAML option present

  Products and areas

• File and attachment handling, both upload and the URLs attachments are served from

  Products and areas

• Formula, rollup and lookup field evaluation, where stored expressions are computed server-side

  Products and areas

• Shared views and shared bases, the surface NocoDB exposes to people with a link and no account, including password-protected shares

  Products and areas

• The external data source connectors, the part of the product that holds database credentials and turns interface actions into queries against somebody's production database

  Products and areas

• The import and export tooling, including Airtable import, CSV and Excel parsing

  Products and areas

• The metadata database, which holds connection strings and credentials for every source the instance fronts

  Products and areas

• The query construction layer in full: filters, sorts, groupings, formula fields, aggregations and every other place a user parameter becomes part of SQL

  Products and areas

• The repository policy asks for private reports at a dedicated security address and through GitHub, and it states no component carve-out, so the whole of NocoDB is in scope

  Products and areas

• The REST API and the API token mechanism, which exposes table data to scripted consumers

  Products and areas

• The workspace, base and table permission model, including the checks that keep one team's bases out of another's reach

  Products and areas

• Webhooks and automations, where a record change triggers an outbound request to a destination the user supplies

  Products and areas

No target matches. Try part of a host name, such as the company name.