OpenSSH bug bounty programs

OpenSSH programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
OP OpenSSH Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• OP

  OpenSSH

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.openssh.com

  Web

• Key and configuration parsing everywhere it happens: authorized_keys, known_hosts, private key files and sshd_config, including Match block evaluation and option expansion

  Products and areas

• Reports go privately to the OpenSSH developers at their security address, against OpenSSH portable or the OpenBSD tree rather than a vendor's patched fork. Everything below sits inside that tree

  Products and areas

• ssh-agent and agent forwarding, where a remote host reaches back into the client's key material

  Products and areas

• The authentication methods in full: public key, keyboard-interactive, password, host-based and GSSAPI, plus anything that lets a session reach an authenticated state without valid credentials

  Products and areas

• The file-transfer tools, meaning sftp-server and the scp path handling, including filename and glob expansion that crosses the boundary between what the client asked for and what the server delivers

  Products and areas

• The key-management utilities, ssh-keygen and ssh-keyscan, which parse material supplied by whoever generated or served it

  Products and areas

• The privilege-separation boundary, where the unprivileged pre-auth process talks to the privileged monitor, and any way the child can drive the parent past its intended checks

  Products and areas

• The whole client side of the protocol, where a malicious or compromised server drives ssh, scp and sftp with attacker-chosen responses

  Products and areas

• The whole of sshd, starting with the pre-authentication code paths: version and banner exchange, binary packet protocol framing, key exchange and the algorithm negotiation that precedes any credential check

  Products and areas

No target matches. Try part of a host name, such as the company name.