sorona.xyz bug bounty programs
sorona.xyz Updated
Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 6
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program sorona.xyz runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
sorona.xyz
Sorona · Bug bounty |
– | – | – | $50 | $1,500 | Full | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $50
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
6 targets. 5 excluded.
-
https://sorona.xyz
Web
-
Notification, disclosure, and maintainer-delivery pipelines where a sorona.xyz flaw could leak or alter vulnerability data
Products and areas
-
Payout and public-feed integrity where a sorona.xyz flaw could falsify records, expose identity, or cross an authorization boundary
Products and areas
-
Proof-of-concept storage, download, and Google Drive handoff logic implemented by sorona.xyz
Products and areas
-
The private triage and submission-operator surfaces, including role enforcement and report lifecycle actions
Products and areas
-
The public sorona.xyz website, submission forms, researcher inbox, and authentication or session boundaries hosted on sorona.xyz
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Denial of service, load testing, rate-limit exhaustion, spam, social engineering, and physical attacks
-
Disclosure of information intentionally public on sorona.xyz, including opted-in Wall of Appreciation handles
-
Reports that depend on compromised credentials, access to another person's email or device, or actions already available to the same authorized role
-
Self-XSS, missing best-practice headers without demonstrated impact, clickjacking on pages with no sensitive action, and scanner-only reports without a working proof
-
Third-party services and infrastructure, including Google, GitHub, GitLab, Railway, Slack, Discord, Resend, and their own products or accounts
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under sorona.xyz: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.