sorona.xyz bug bounty programs

sorona.xyz programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
SC step-ca Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• SC

  step-ca

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://smallstep.com/docs/step-ca

  Web

• Certificate templates, the claims a provisioner enforces and the constraints it applies to a request's subject, SANs, key usages and validity

  Products and areas

• Every provisioner type: JWK, OIDC, AWS, GCP and Azure instance identity, X5C, SSHPOP, K8sSA, ACME, SCEP and Nebula

  Products and areas

• Renewal and rekey, including the mutual TLS authenticated renewal endpoint where the presented certificate is the credential

  Products and areas

• Revocation end to end: the revocation endpoints, the CRL, the OCSP responder and the SSH revocation list

  Products and areas

• The ACME server and every challenge type it implements: http-01, dns-01, tls-alpn-01 and device-attest-01, along with account handling, order state and the authorization objects behind them

  Products and areas

• The admin API, the provisioner and admin management endpoints, and registration authority mode where step-ca fronts another CA

  Products and areas

• The bootstrap and trust establishment flow, including how a client first learns and pins the CA's root

  Products and areas

• The CA's own key handling and every KMS integration, covering PKCS#11 modules, YubiKey and the cloud KMS backends

  Products and areas

• The database backends storing issued certificates, provisioner state and revocation records

  Products and areas

• The published policy asks for reports at [email protected] and appreciates responsible disclosure without offering a reward. It declares no boundary narrower than step-ca itself

  Products and areas

• The SCEP server, its challenge handling, the enrolment and renewal operations and the PKCS#7 and PKCS#10 processing beneath them

  Products and areas

• The SSH certificate authority: host and user certificate issuance, principal handling, extensions, critical options and the SSH-specific provisioner paths

  Products and areas

• The step CLI where it interacts with the CA, and the ACME and SCEP client behaviour the project ships

  Products and areas

No target matches. Try part of a host name, such as the company name.