Polymer bug bounty programs
polymer-project.org Updated
Polymer runs one public program: a Sorona bug bounty paying up to $3,100.
- Top reward
- $3,100
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Polymer runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Polymer
Sorona · Bug bounty |
$3,100 | Partial | – | – | Open |
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 9 excluded.
-
https://polymer-library.polymer-project.org
Web
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and Polymer/polymer is named in the published tier file at TIER_OT1: a product vulnerability anywhere in the library's own code is accepted, at $101 to $3,133.70
Products and areas
-
html template literal handling and every path that turns a value into markup, including the DOM writes the library performs on the application's behalf
Products and areas
-
Publication of @polymer/polymer to npm and the integrity of the released package, which Google prices under its separate supply-chain category
Products and areas
-
Styling and encapsulation: how the library uses Shadow DOM, how it falls back to the ShadyDOM and ShadyCSS polyfills, and custom-property and style-module resolution
Products and areas
-
Template stamping and data binding, covering the {{ }} and [[ ]] evaluators, attribute and property bindings, and event-handler bindings
Products and areas
-
The helper elements the library ships: dom-repeat, dom-if, dom-bind and dom-module, and the templatizer they are built on
Products and areas
-
The legacy layer that still ships: Polymer({}) behaviours, the 1.x compatibility shims, gesture and event handling, and the async and utility modules
Products and areas
-
The PolymerElement base class in full: the property system, property effects, observers, computed and read-only properties, and the element lifecycle
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 9
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Applications built on Polymer rather than defects in the library itself
-
Browser polyfill gaps in legacy browsers the project no longer supports
-
Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions
-
Deprecated 1.x-only APIs that the project no longer ships
-
Lit and lit-html, the successor libraries, which are not listed in Google's repository tier file
-
Other repositories in the Polymer org, which the tier file does not list and which pay nothing for a product vulnerability after the April 2026 rules update
-
Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees
-
Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue
-
Third-party Polymer element collections published outside the Polymer organisation
Recent changes
Reward and scope changes across every Polymer program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under polymer-project.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.