Botan bug bounty programs

Botan programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
BO Botan Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• BO

  Botan

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://botan.randombit.net

  Web

• Every block cipher, stream cipher, hash, MAC and AEAD mode the library ships, including the tag verification paths

  Products and areas

• Key derivation, password hashing and the PBKDF and KDF families

  Products and areas

• The ASN.1 and BER decoder, which parses attacker-supplied structure before any signature has been checked

  Products and areas

• The botan command line tool and the utility subcommands that parse files supplied by someone else

  Products and areas

• The certificate store implementations and the platform trust store integrations that feed anchors into path validation

  Products and areas

• The FFI layer and the Python bindings built on it, where a wrapper can lose a check the C++ API enforces

  Products and areas

• The public key algorithms: RSA, the elliptic curve implementations, the signature and key agreement schemes, and the post-quantum algorithms Botan has added

  Products and areas

• The published policy asks for any suspected security bug in Botan through the private GitHub flow or direct maintainer contact, qualified only by the project's own threat model. It draws no boundary narrower than the Botan tree

  Products and areas

• The random number generators, their seeding, their reseeding policy and their behaviour across fork

  Products and areas

• The TLS implementation on both sides, covering TLS 1.2 and TLS 1.3 handshake state, the record layer, session resumption, PSK handling and the callback surface embedders use to accept or reject a peer

  Products and areas

• The X.509 implementation in full: certificate parsing, path building, trust anchor selection, name constraints, policy constraints, CRL handling and OCSP

  Products and areas

No target matches. Try part of a host name, such as the company name.