strongSwan bug bounty programs

strongSwan programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
ST strongSwan Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• ST

  strongSwan

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.strongswan.org

  Web

• Credential and PKI handling in the pki tool and the credential plugins: X.509 chain building, CRL and OCSP processing, and the RSA and ECDSA verification paths

  Products and areas

• Reports go to the strongSwan security address, which also serves as the project's OSS-Fuzz contact, and the object is the upstream strongSwan tree rather than a vendor's appliance fork or another IPsec implementation

  Products and areas

• The authentication plugin family end to end, EAP-TLS, EAP-TTLS and EAP-MSCHAPv2 included, together with the identity-matching logic that turns an exchange into an authentication decision

  Products and areas

• The charon daemon in full: the IKEv1 and IKEv2 message parsers reachable pre-authentication on UDP/500 and UDP/4500, and the state machine behind them

  Products and areas

• The kernel interface plugins, kernel-netlink above all, and XFRM policy and SA installation, where a policy confusion becomes a traffic-selector bypass

  Products and areas

• The vici and swanctl control interface and the legacy stroke socket

  Products and areas

No target matches. Try part of a host name, such as the company name.