Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

The Sleuth Kit bug bounty programs

sleuthkit.org Updated

The Sleuth Kit runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program The Sleuth Kit runs.

  • The Sleuth Kit

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 5 excluded.

  • https://www.sleuthkit.org

    Web

  • Reports go to [email protected], per the repository's SECURITY.md, against upstream sleuthkit/sleuthkit. Autopsy is a separate repository, so the boundary is the TSK tree and all of it

    Products and areas

  • The carving code paths and the hash-database lookups, NSRL handling included

    Products and areas

  • The command-line tools investigators point straight at seized media, tsk_recover, fls, icat, mmls and blkls among them

    Products and areas

  • The filesystem layer in tsk/fs in full: NTFS, FAT12/16/32 and exFAT, Ext2/3/4, HFS+, APFS, UFS, YAFFS2, ISO9660 and everything else it claims to read

    Products and areas

  • The image layer in tsk/img, covering the raw, AFF, E01/EWF, VMDK and VHD containers that are parsed before any filesystem logic runs

    Products and areas

  • The Java bindings in bindings/java and the SQLite case database that Autopsy drives on top of them

    Products and areas

  • The volume-system layer in tsk/vs, covering DOS, GPT, BSD and Sun partition tables

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Autopsy itself, which is a separate repository and not part of this target

  • For the Google money specifically, anything reported but never patched upstream, since that pathway pays only on a merge

  • Non-exploitable crashes whose fix is a one-liner, which Google explicitly declines to reward on the patch rail

  • Patches over twelve months old, which Patch Rewards will not consider

  • Third-party ingest modules and Autopsy plugins, which are neither maintained nor merged here

Recent changes

Reward and scope changes across every The Sleuth Kit program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in The Sleuth Kit products, from the NVD.

Search NVD
  • CVE-2026-40025 Medium

    The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled length fields without bounds checking, causing heap reads past the allocated buffer. An attacker can craft a malicious APFS disk image that triggers information disclosure or crashes when processed by any Sleuth Kit tool that

  • CVE-2026-40026 Medium

    The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SUSP block. An attacker can craft a malicious ISO image that causes reads past the end of the SUSP

  • CVE-2026-40024 High

    The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery directory via crafted filenames or directory paths with path traversal sequences in a filesystem image. An attacker can craft a malicious filesystem image with embedded /../ sequences in filenames that, when processed by ts

  • CVE-2022-45639 High

    OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.

  • CVE-2020-10232 Critical

    In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.

  • CVE-2020-10233 Critical

    In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.

  • CVE-2019-14531 Critical

    An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol data in fs/iso9660.c.

  • CVE-2019-14532 Critical

    An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.

About this page

This page gathers every public program listed under sleuthkit.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.