sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
NJ Node.js Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• NJ

  Node.js

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://github.com/nodejs/node

  Web

• Path, filename and URL handling across the fs and url APIs, especially the Windows-specific normalisation differences that let a check and a use disagree

  Products and areas

• The bundled dependencies as Node exposes them, wherever Node's own use of them is what creates the impact

  Products and areas

• The crypto and TLS bindings as Node drives them, including certificate and hostname verification and the defaults exposed to callers

  Products and areas

• The entire C and C++ layer: the native bindings, the stream and buffer implementations, and anything that turns a JavaScript-supplied length or offset into an out-of-bounds access

  Products and areas

• The module system end to end, covering CommonJS and ESM resolution, loaders and hooks, integrity enforcement, and anything that loads code the caller did not intend

  Products and areas

• The permission model in full, including its policy flags and every boundary it claims to enforce over files, network destinations and child processes

  Products and areas

• The process and isolation boundaries: child_process, worker_threads and vm, where argument or environment handling crosses from untrusted input into process creation

  Products and areas

• The project's SECURITY.md takes reports against Node.js core on any release line still in support. The whole runtime sits inside that: the JavaScript APIs, the native layer, and the bundled dependencies as Node itself uses them

  Products and areas

• The whole HTTP surface: HTTP/1.1 and HTTP/2 request handling, header, chunked-encoding and trailer parsing, and any divergence from a front-end proxy that enables request smuggling or desync

  Products and areas

No target matches. Try part of a host name, such as the company name.