Scala bug bounty programs

Scala programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
SC Scala Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	2 days promised	Open

• SC

  Scala

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  2 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.scala-lang.org

  Web

• scala.util.matching and the regular-expression surface, plus the parser combinators and any other text-processing code the distribution ships

  Products and areas

• Serialisation of Scala objects, including the interaction between Scala's collection and function classes and Java deserialisation

  Products and areas

• The compiler across the supported lines: parsing, typechecking, implicit resolution, macro expansion and the bytecode the back end emits

  Products and areas

• The compiler plugin interface and anything a plugin can do to emitted bytecode

  Products and areas

• The compiler's handling of untrusted source, which matters directly for anything that compiles user-submitted code

  Products and areas

• The macro system and compile-time execution, since compiling a project runs code that project supplied

  Products and areas

• The published security process asks for vulnerabilities by email to the project's security address and sets a two-business-day acknowledgement target. It declares no narrower scope, so the compiler, the standard library and the release tooling are all in

  Products and areas

• The release and publication path: signing, the PGP keys the project publishes and the artifacts pushed to Maven Central

  Products and areas

• The REPL and the scripting entry points, which evaluate source straight from input

  Products and areas

• The standard library: collections, scala.io, scala.sys.process, string handling and the implicit machinery that decides what code runs

  Products and areas

No target matches. Try part of a host name, such as the company name.