Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Freedom of the Press Foundation bug bounty programs

securedrop.org Updated

Freedom of the Press Foundation runs one public program: a Sorona bug bounty paying up to $2,500.

Top reward
$2,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Freedom of the Press Foundation runs.

  • SecureDrop

    Sorona · Bug bounty

    Open

    Top reward

    $2,500
    Critical
    $2,500
    High
    $1,500
    Medium
    $750
    Low
    $200
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 7 excluded.

  • https://securedrop.org

    Web

  • Cryptography and credential handling throughout: the GPG submission keys, source codenames, journalist passphrases and two-factor enrolment, and the key material the client holds

    Products and areas

  • SecureDrop Client in full: the journalist application, its sync against the Journalist API, the local database and file store, and the export and print paths through the dedicated qubes

    Products and areas

  • SecureDrop Workstation in full: the Qubes qube layout, the inter-qube RPC policies, the dom0 salt provisioning and the updater that keeps it current

    Products and areas

  • The deployment code those repositories ship: the Debian packages, the Ansible playbooks and the securedrop-admin tooling an operator runs to stand an instance up

    Products and areas

  • The engagement's complete target list is three repositories and nothing else: freedomofpress/securedrop, freedomofpress/securedrop-workstation and freedomofpress/securedrop-client. Source code only, at the full $100 to $2,500 range

    Products and areas

  • The network and service layer as SecureDrop configures it: the onion services and their client authorisation, the Tor configuration the installer writes, and the OSSEC monitoring and alerting path

    Products and areas

  • The SecureDrop server in full: the Source Interface and the Journalist Interface, the Flask applications behind both, submission and reply handling, the Journalist API, and the application and monitor servers

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 7

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Classes the Bugcrowd VRT excludes by default, since the empty out-of-scope list means the taxonomy governs: self-XSS, missing security headers and best-practice observations

  • Configuration mistakes by a particular newsroom operator, as opposed to a defect in what the project ships

  • Defects that actually live in Tor, Qubes OS or Debian upstream rather than in SecureDrop's own code, which belong to those projects

  • Downstream newsroom deployments, which individual news organisations run themselves and which are not the funder's assets to authorise testing against

  • Findings that assume the attacker already holds journalist credentials or the instance's keys, which sits inside the trust boundary rather than across it

  • Hosted and vendor-operated assets: nothing on securedrop.org or freedom.press is in scope, because the engagement lists no hosted target at all

  • Reports filed outside Bugcrowd, or by anyone unwilling to hold a Bugcrowd account on the platform's standard payment terms, since the engagement pays no other way

Recent changes

Reward and scope changes across every Freedom of the Press Foundation program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under securedrop.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.