OpenSSL bug bounty programs

OpenSSL programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
OP OpenSSL Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
OP OpenSSL Self-hosted · Disclosure only	–	–	–	–	No cash	None	–	–	Open

• OP

  OpenSSL

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• OP

  OpenSSL

  Self-hosted · Disclosure only

  Open

  Top reward

  No cash

  Safe harbor

  None

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• openssl.org

  Domains

  Covered by Self-hosted

• https://www.openssl.org

  Web

  Covered by Sorona

• OpenSSL library

  Source code

  Covered by Self-hosted

• ASN.1 and DER decoding of attacker-supplied certificates, keys, and structures

  Products and areas

  Covered by Sorona

• Cryptographic implementation flaws with demonstrated impact, including timing and side-channel leakage in supported operations

  Products and areas

  Covered by Sorona

• Parsing of PKCS containers from untrusted data (PKCS#7, PKCS#8, PKCS#12) and PEM handling

  Products and areas

  Covered by Sorona

• Reports go privately to the OpenSSL security team at [email protected] and cover OpenSSL's own code; a defect that lives in a bundled dependency goes to that project instead

  Products and areas

  Covered by Sorona

• The provider and ENGINE interfaces where untrusted configuration or input crosses into library state

  Products and areas

  Covered by Sorona

• The TLS and DTLS handshake and record layers, covering key exchange, session resumption, renegotiation, and fragment reassembly

  Products and areas

  Covered by Sorona

• The whole of libcrypto and libssl as reachable from untrusted network peers, including heap and stack overflows, use-after-free, and out-of-bounds reads or writes

  Products and areas

  Covered by Sorona

• X.509 certificate parsing and chain building, including path validation, name-constraint enforcement, and CRL and OCSP handling, and anything that lets an attacker bypass verification

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.