Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

ScyllaDB Ltd bug bounty programs

scylladb.com Updated

ScyllaDB Ltd runs one public program: a Sorona bug bounty.

Top reward
Not published
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program ScyllaDB Ltd runs.

  • ScyllaDB

    Sorona · Bug bounty

    Open

    Top reward

    Not published
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 6 excluded.

  • https://www.scylladb.com

    Web

  • ScyllaDB Alternator, the DynamoDB-compatible frontend that ships inside the open-source server, including request signing, authentication and per-table isolation

    Products and areas

  • ScyllaDB Enterprise and ScyllaDB Cloud, both named in the eligible list, neither of them open source

    Products and areas

  • ScyllaDB Manager, which schedules backup, restore and repair across a cluster

    Products and areas

  • ScyllaDB Monitoring Stack (scylladb/scylla-monitoring, Apache-2.0): the Prometheus and Grafana deployment, its dashboards, alert rules and the scrape configuration holding cluster endpoints and credentials

    Products and areas

  • ScyllaDB Operator (scylladb/scylla-operator, Apache-2.0) in full: the Kubernetes controller, its custom resources, the RBAC it provisions and the sidecar running beside each node

    Products and areas

  • The eligible-products list is the declaration and it names seven: ScyllaDB Cloud, ScyllaDB Enterprise, ScyllaDB Alternator, ScyllaDB Monitoring Stack, ScyllaDB Manager, ScyllaDB Drivers and ScyllaDB Operator. Impact has to be shown against ScyllaDB or its clients, and the list is mutable at ScyllaDB's sole discretion

    Products and areas

  • The ScyllaDB drivers, meaning the Go, Java, Python, Rust and C++ client repositories, covering CQL wire-protocol handling, TLS verification and connection management

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Any denial-of-service attack against ScyllaDB products or ScyllaDB customers, which is excluded even though DoS is 25% of the recorded bug distribution

  • Any vulnerability obtained through the compromise of a ScyllaDB customer or employee account

  • ScyllaDB web site domains and any related subdomains, which the program places out of scope explicitly

  • Social engineering of ScyllaDB employees, contractors, vendors or service providers, plus malware distribution and spam. Conducting any of these means permanent disqualification from the program

  • Targeting assets belonging to ScyllaDB's customers

  • The AGPL core server repository scylladb/scylladb, which is not named in the eligible-products list; the server is only reachable through Alternator, which is named

Recent changes

Reward and scope changes across every ScyllaDB Ltd program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under scylladb.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.