SurrealDB bug bounty programs

SurrealDB programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
SU SurrealDB Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	3 days promised	Open

• SU

  SurrealDB

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://surrealdb.com

  Web

• Authentication in full, covering root, namespace, database and record users, the signin and signup flows, and session lifetime

  Products and areas

• Custom API routes and the machinery that lets a definition specify the namespace and database a request runs against

  Products and areas

• Embedded scripting functions and the boundary between them and the host process

  Products and areas

• Graph traversal and record links, where a query reaches a record through a relationship rather than by selecting it directly

  Products and areas

• Import, export and backup handling, plus the CLI and the embedded library builds that share the same core

  Products and areas

• Live queries and change feeds, and whether a subscriber keeps receiving rows it has lost the right to see

  Products and areas

• SurrealQL parsing and execution, including parameter binding, subqueries and the places a value can become syntax

  Products and areas

• The HTTP REST surface, the RPC and WebSocket protocol, and any difference in how the two enforce the same check

  Products and areas

• The permission model end to end: table, field and record-level PERMISSIONS clauses, and every place a clause is evaluated for a read, a write or a delete

  Products and areas

• The published policy asks for any security issue privately by email or GitHub advisory and promises acknowledgement, confidentiality, safe harbour and credit in return. It names no assets and carves nothing out, so the SurrealDB tree itself is the boundary

  Products and areas

• The storage engine layer as SurrealDB drives it, covering the in-memory, RocksDB, SurrealKV and TiKV backends

  Products and areas

• Token handling: JWT verification, the algorithms accepted, JWKS fetching and caching, and the claims a token is trusted to assert

  Products and areas

No target matches. Try part of a host name, such as the company name.