Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Suricata bug bounty programs

suricata.io Updated

Suricata runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Suricata runs.

  • Suricata

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 6 excluded.

  • https://suricata.io

    Web

  • Report through the process in Suricata's SECURITY.md, which the OISF runs around the project's release cadence with its own severity levels. The engine repository is the object: the Suricata-Update tool and SuriControl live in separate repositories, and everything else in the engine is in play

    Products and areas

  • The application-layer parsers as a whole, an unusually large mixed Rust and C surface covering HTTP/1, HTTP/2, TLS, SMB, DCERPC, DNS, SSH, MQTT, Modbus, ENIP, DNP3, NFS, SMTP, FTP, RDP and QUIC among others

    Products and areas

  • The capture and packet-acquisition paths, including the NFQUEUE, AF_PACKET and DPDK modes that run inline with elevated privileges in IPS deployments

    Products and areas

  • The detection engine and rule parser under detect-* in full, including the PCRE and Hyperscan integration that compiles attacker-influenced patterns

    Products and areas

  • The output layer, EVE JSON above all, where attacker-influenced field values reach a serialiser and then whatever consumes it

    Products and areas

  • The stream reassembly and defragmentation engine, together with the flow and session state it maintains

    Products and areas

  • The unix socket control interface, and the configuration and ruleset loading that runs behind it

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything not merged upstream, and anything reverted within the first month after it lands

  • Detection bypasses and evasion techniques that are rule-coverage gaps rather than defects in the engine's code

  • Non-exploitable crash fixes at one-liner scale, and denial of service through resource exhaustion, which the reward rules place below the bar

  • Patches younger than one month or older than twelve, which the reward age window excludes at both ends

  • Rulesets such as Emerging Threats and Talos, which are separate products and not Suricata code

  • The Suricata-Update Python tool and SuriControl, which live in their own repositories and are not covered here unless they are in OSS-Fuzz in their own right

Recent changes

Reward and scope changes across every Suricata program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under suricata.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.