Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Ruby bug bounty programs

ruby-lang.org Updated

Ruby runs two public programs: a Sorona bug bounty paying up to $1,500 and a HackerOne bug bounty.

Top reward
$1,500
Sorona
Programs
2
2 pay cash
Targets in scope
14
3 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Ruby

Sorona · Pays the most of the 2 programs: up to $1,500.
  • Ruby

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100 (highest)
    Safe harbor
    Partial
  • Ruby

    HackerOne · Bug bounty

    Open

    Top reward

    Not published
    Safe harbor
    Full
    First response
    5 days average

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

14 targets across all 2 programs, each listed once with the programs that cover it. 7 excluded.

  • https://www.ruby-lang.org

    Web

    Covered by Sorona

  • https://github.com/ruby/ruby

    Source code Critical No bounty

    Covered by HackerOne

  • IO, process spawning and every path where a Ruby string becomes a shell command or a filesystem path

    Products and areas

    Covered by Sorona

  • Marshal and every other core path that reconstructs a Ruby object from bytes

    Products and areas

    Covered by Sorona

  • Memory management, covering the garbage collector, object allocation and the C API that native extensions use to touch both

    Products and areas

    Covered by Sorona

  • RubyGems and Bundler as shipped, covering registry communication, gem installation and any build step a gem can declare

    Products and areas

    Covered by Sorona

  • String, array and hash handling in the C source, and the encoding machinery underneath strings

    Products and areas

    Covered by Sorona

  • The C extension API and anything a native gem can do to interpreter invariants

    Products and areas

    Covered by Sorona

  • The default and bundled standard library gems, including net-imap, net-http, uri, resolv, cgi, rexml, psych, openssl and json

    Products and areas

    Covered by Sorona

  • The dynamic evaluation surface: eval, instance_eval, send and the metaprogramming entry points that turn a string into executing code

    Products and areas

    Covered by Sorona

  • The interpreter core: the parser, the compiler, the YARV virtual machine and the object system

    Products and areas

    Covered by Sorona

  • The programme accepts vulnerabilities in the Ruby interpreter through either published channel and states plainly that it carries no money. It declares no component carve-out, so CRuby as shipped, including the gems each release bundles, is the target

    Products and areas

    Covered by Sorona

  • The Ractor and Fiber concurrency machinery and whatever isolation it is meant to provide

    Products and areas

    Covered by Sorona

  • The regular-expression engine and the pattern-compilation path, including the behaviour that produces catastrophic backtracking

    Products and areas

    Covered by Sorona

No target matches. Try part of a host name, such as the company name.

Out of scope 7

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.ruby-lang.org

    HackerOne

  • Distribution packaging and distro-specific patches rather than upstream CRuby

    Sorona

  • JRuby, TruffleRuby and other implementations, which are separate projects

    Sorona

  • Rails and other frameworks, each with its own security process

    Sorona

  • Ruby application code with an injection bug of its own, as distinct from an interpreter defect

    Sorona

  • Running untrusted Ruby source deliberately, since the interpreter ships no sandbox

    Sorona

  • Third-party gems that a Ruby release does not bundle

    Sorona

Recent changes

Reward and scope changes across every Ruby program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Ruby products, from the NVD.

Search NVD
  • CVE-2026-97229 Critical

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

  • CVE-2026-97229 Critical

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

  • CVE-2026-46727 High

    An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-base

  • CVE-2026-46727 High

    An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-base

  • CVE-2026-42258 Medium

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

  • CVE-2026-42258 Medium

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

  • CVE-2026-42245 Low

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in v

  • CVE-2026-42246 High

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

About this page

This page gathers every public program listed under ruby-lang.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.