RabbitMQ bug bounty programs

RabbitMQ programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
RA RabbitMQ Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• RA

  RabbitMQ

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.rabbitmq.com

  Web

• AMQP 0-9-1 and AMQP 1.0 frame parsing, channel handling and the connection negotiation in front of both

  Products and areas

• Clustering, Erlang distribution between nodes, the shared cluster cookie and the peer discovery backends

  Products and areas

• Plugin loading, the plugin directory and what an enabled plugin can reach inside the node

  Products and areas

• Queue types and their implementations: classic queues, quorum queues and the Raft implementation behind them, and streams

  Products and areas

• rabbitmqctl, rabbitmq-diagnostics and the Erlang remote shell path they use to reach a running node

  Products and areas

• Shovel and federation, the plugins that connect one broker to another, along with the credentials and TLS settings on those links

  Products and areas

• The authentication and authorization backends in full: internal, LDAP, HTTP, OAuth 2 and JWT, and the cache backend in front of them

  Products and areas

• The management plugin, its HTTP API, its web UI and the definitions import and export it performs

  Products and areas

• The MQTT, STOMP, Web-MQTT and Web-STOMP plugins and the protocol handling each adds

  Products and areas

• The permission model across virtual hosts, exchanges, queues and topics, including topic authorization and the regular expressions permissions are written as

  Products and areas

• The project's security page asks for a private GitHub Security Advisory on rabbitmq/rabbitmq-server, with a Broadcom PSIRT address as fallback. It declares no boundary narrower than the broker the project ships

  Products and areas

• The Prometheus and management metrics endpoints and what an unauthenticated caller can read from them

  Products and areas

• The stream protocol and its plugin, which is a separate wire protocol with its own authentication

  Products and areas

• TLS termination on every listener, peer certificate verification and the mapping from a certificate to a RabbitMQ user

  Products and areas

No target matches. Try part of a host name, such as the company name.