sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
PI pip Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
SE setuptools Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• PI

  pip

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• SE

  setuptools

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://pip.pypa.io

  Web

  Covered by pip

• https://setuptools.pypa.io

  Web

  Covered by setuptools

• Archive handling in full, covering wheel and sdist extraction, path traversal on unpack, and symlink handling

  Products and areas

  Covered by pip

• Build-backend invocation through setup.py and pyproject.toml, which is arbitrary code execution at install time and therefore worth attacking from the metadata side

  Products and areas

  Covered by pip

• Credential handling for ~/.netrc, keyring integrations and index URLs that carry secrets, including anything that sends a credential to the wrong host

  Products and areas

  Covered by pip

• easy_install and PackageIndex, including URL and link handling and the download-and-execute path behind them

  Products and areas

  Covered by setuptools

• Hash and integrity checking, including any gap that lets --require-hashes or a --hash pin be satisfied by content that does not match

  Products and areas

  Covered by pip

• Installation targets and environment handling, covering virtual environments, --target and --prefix, and anything that writes outside where the user asked

  Products and areas

  Covered by pip

• Metadata parsing across every format pip reads, including wheel metadata, requirement specifiers, constraint files and requirements files

  Products and areas

  Covered by pip

• pkg_resources as a whole: requirement, version and metadata parsing across METADATA, PKG-INFO and entry points

  Products and areas

  Covered by setuptools

• Reports go through the PyPA security process described in SECURITY.md and cover pip itself. setuptools, wheel and packaging are separate upstreams with their own processes

  Products and areas

  Covered by pip

• Reports go to PyPA through the process in the project's SECURITY.md, against setuptools itself. pip, wheel and packaging are separate projects, so the boundary is the setuptools tree and all of it

  Products and areas

  Covered by setuptools

• sdist and egg unpacking, including archive path handling at extraction time

  Products and areas

  Covered by setuptools

• setup.py argument and configuration handling wherever attacker-controlled project metadata reaches a subprocess

  Products and areas

  Covered by setuptools

• The network layer and pip's local HTTP cache, where one install can seed what a later install trusts

  Products and areas

  Covered by pip

• The PEP 517 build-backend entry points in full, the mechanism by which pip install executes arbitrary code out of a source distribution

  Products and areas

  Covered by setuptools

• The whole index and resolver path: how --index-url and --extra-index-url are handled, how candidates are selected, and any dependency confusion between a private and a public index

  Products and areas

  Covered by pip

No target matches. Try part of a host name, such as the company name.