sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
OG OpenTelemetry Go Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
OC OpenTelemetry Collector Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• OG

  OpenTelemetry Go

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• OC

  OpenTelemetry Collector

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://opentelemetry.io

  Web

  Covered by OpenTelemetry Go

• https://opentelemetry.io/docs/collector

  Web

  Covered by OpenTelemetry Collector

• Baggage and TraceContext header parsing, which processes attacker-controllable HTTP headers on every single request

  Products and areas

  Covered by OpenTelemetry Go

• Cardinality control and attribute handling in the metric SDK, the point at which a request attribute becomes a metric label and an allocation

  Products and areas

  Covered by OpenTelemetry Go

• Connectors and the service graph that routes data between pipelines

  Products and areas

  Covered by OpenTelemetry Collector

• Every exporter and the credentials it holds for its backend, along with the retry and queue behaviour behind it

  Products and areas

  Covered by OpenTelemetry Collector

• Every receiver, starting with OTLP over gRPC and HTTP, and extending across the Prometheus, Jaeger, Zipkin, Fluent Forward, syslog, statsd, kafka, filelog, hostmetrics and webhook receivers in contrib

  Products and areas

  Covered by OpenTelemetry Collector

• Exporter transport and configuration, covering endpoint selection, TLS setup and the credentials an exporter carries off-host

  Products and areas

  Covered by OpenTelemetry Go

• Extensions in full, covering the auth extensions (bearer token, OIDC, basic auth, sigv4, headers setter), the health check, pprof and zpages

  Products and areas

  Covered by OpenTelemetry Collector

• open-telemetry/opentelemetry-go in full: the trace, metric and log SDKs, the OTLP exporters over gRPC and HTTP, the W3C TraceContext and Baggage propagators, and the semantic-convention packages

  Products and areas

  Covered by OpenTelemetry Go

• open-telemetry/opentelemetry-go-contrib in full, meaning every instrumentation library it carries, of which otelhttp and otelgrpc matter most because they sit in the request path of an enormous number of Go services

  Products and areas

  Covered by OpenTelemetry Go

• Protobuf and JSON decoding on the OTLP receive and export paths

  Products and areas

  Covered by OpenTelemetry Go

• The batch processor, the memory limiter and the behaviour of the whole pipeline under load or backpressure

  Products and areas

  Covered by OpenTelemetry Collector

• The builder that assembles a custom distribution and the component manifest it consumes

  Products and areas

  Covered by OpenTelemetry Collector

• The Collector's own internal telemetry: the metrics it exposes about itself and the debug surfaces that describe its configuration

  Products and areas

  Covered by OpenTelemetry Collector

• The configuration loader, environment variable expansion, and the confmap providers that resolve configuration from a file, an HTTP endpoint, S3 or another remote source

  Products and areas

  Covered by OpenTelemetry Collector

• The OpAMP supervisor and remote configuration where it is enabled, which lets a control server change what the Collector runs

  Products and areas

  Covered by OpenTelemetry Collector

• The processors, in particular the transform, filter, attributes, redaction and tail sampling processors that decide what leaves the pipeline

  Products and areas

  Covered by OpenTelemetry Collector

• The project takes reports at [email protected] or through GitHub private advisory reporting and publishes a GHSA. The Google patch pathway is narrower and reaches two repositories only: opentelemetry-go and opentelemetry-go-contrib

  Products and areas

  Covered by OpenTelemetry Go

• The security process asks for a private GitHub advisory on the collector repositories with [email protected] as fallback, and declares no boundary narrower than the Collector itself. Both the core and contrib repositories sit inside it

  Products and areas

  Covered by OpenTelemetry Collector

• TLS configuration on every receiver and exporter, including certificate verification, minimum versions and mutual TLS

  Products and areas

  Covered by OpenTelemetry Collector

No target matches. Try part of a host name, such as the company name.