Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

OpenSearch bug bounty programs

opensearch.org Updated

OpenSearch runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program OpenSearch runs.

  • OpenSearch

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 6 excluded.

  • https://opensearch.org

    Web

  • Cross-cluster search and replication, where one cluster acts on behalf of a user against another

    Products and areas

  • OpenSearch Dashboards in full: session handling, saved objects, the proxy that forwards browser requests into the cluster, and the visualisation rendering surface

    Products and areas

  • Query DSL parsing, aggregations, scripting through Painless and the sandbox around it, and the ingest pipeline processors

    Products and areas

  • Snapshot and restore, including repository configuration, remote storage credentials and the restore path that writes index data back into a cluster

    Products and areas

  • The alerting, anomaly detection, index management, observability, notifications and reporting plugins, including any outbound request they make on a schedule

    Products and areas

  • The multi-tenancy features in Dashboards, which are the boundary an operator relies on to keep teams apart in a shared deployment

    Products and areas

  • The policy asks for any suspected security issue by email to the project security address and declares no component carve-out. The engine, Dashboards and the plugins the project publishes are all inside it

    Products and areas

  • The REST layer in full, covering search, index, bulk, mapping, cluster and cat APIs, along with the request-parsing and authorisation checks in front of them

    Products and areas

  • The security plugin end to end: authentication backends, roles and role mappings, index and document permissions, field-level security and document-level security

    Products and areas

  • The SQL and PPL query interfaces, which translate a text query into cluster operations under a caller's identity

    Products and areas

  • The transport layer and inter-node communication, including node join, cluster state propagation and any request that arrives already trusted

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A cluster deployed without the security plugin, without TLS or on an open network, all of which are operator decisions

  • Aiven's managed OpenSearch and Aiven's own repositories, which sit inside a separate programme

  • Amazon OpenSearch Service, Amazon OpenSearch Serverless and the other AWS-managed offerings, which are a cloud service with their own reporting path

  • Elasticsearch and Kibana, a different product line under a different vendor with its own paid programme

  • Third-party plugins that are not published by the OpenSearch project

  • Upstream dependencies, unless OpenSearch's own use of them is what makes the defect reachable

Recent changes

Reward and scope changes across every OpenSearch program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in OpenSearch products, from the NVD.

Search NVD
  • CVE-2024-39900 Medium

    OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included

  • CVE-2024-39901 Medium

    OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are includ

About this page

This page gathers every public program listed under opensearch.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.