Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

OpenThread bug bounty programs

openthread.io Updated

OpenThread runs one public program: a Sorona bug bounty paying up to $7,500.

Top reward
$7,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program OpenThread runs.

  • OpenThread

    Sorona · Bug bounty

    Open

    Top reward

    $7,500
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 9 excluded.

  • https://openthread.io

    Web

  • 6LoWPAN header compression and decompression, fragment reassembly, and the mesh forwarding built on top

    Products and areas

  • Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and openthread/openthread is named in the published tier file at TIER_OT0: a product vulnerability anywhere in the stack's own code is accepted, at $500 to $7,500

    Products and areas

  • Mesh Link Establishment and the whole network formation flow: joining, commissioning, the Joiner and Commissioner roles, the DTLS handshakes underneath them, and the network key, key rotation, Thread Domain material and Operational Dataset they establish

    Products and areas

  • Repository configuration and the release pipeline, which Google prices under its separate supply-chain category

    Products and areas

  • The application protocols the stack terminates: CoAP and CoAPS, the SRP client and server, DNS-SD resolution, the Border Agent, and the border-routing features

    Products and areas

  • The IEEE 802.15.4 layer: MAC frame parsing, MAC security and key handling, the CSL and receive paths, and everything that runs on a frame the radio picks up before anyone has authenticated

    Products and areas

  • The IPv6 stack the project ships: address configuration and resolution, ICMPv6, UDP, multicast forwarding, and the routing logic between mesh nodes

    Products and areas

  • The POSIX platform layer with its daemon and CLI surfaces, the NCP and RCP spinel interface between host and radio co-processor, and the public otXxx API a vendor SDK ports against

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 9

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Attacks that require the Thread network credential the attacker was already given, since that is inside the trust boundary

  • Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions

  • Memory-corruption reports submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch

  • Other repositories in the openthread org, which the tier file does not list and which pay nothing for a product vulnerability after the April 2026 rules update

  • Physical-layer and RF jamming attacks, which the protocol does not claim to defend against

  • Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees

  • Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue

  • Silicon-vendor radio drivers and closed platform layers, which belong to the chip vendor rather than to OpenThread

  • Third-party Thread stacks and vendor forks that are not listed in Google's repository tier file

Recent changes

Reward and scope changes across every OpenThread program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in OpenThread products, from the NVD.

Search NVD
  • CVE-2021-33889 Medium

    OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len.

  • CVE-2020-8916 Medium

    A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to restrict access in your debug environments.

About this page

This page gathers every public program listed under openthread.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.