sorona.xyz bug bounty programs
systemd.io Updated
Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 10
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program sorona.xyz runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
systemd
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
10 targets. 6 excluded.
-
https://systemd.io
Web
-
journald end to end, from records arriving over the socket from unprivileged processes, through indexing, to the files other users read
Products and areas
-
logind and the session and seat logic, including the polkit boundaries that decide which user may act on which session
Products and areas
-
PID 1 itself: unit activation, the D-Bus interfaces systemd exposes, and every boundary an unprivileged user can cross into work that runs as root
Products and areas
-
Reports go to the systemd security address at [email protected], against upstream systemd rather than a distribution's patched build. The object is the whole project, from PID 1 out to every daemon it ships
Products and areas
-
systemd-networkd and the DHCP and NDP client paths, which consume unauthenticated packets from the local network
Products and areas
-
systemd-resolved in full, which parses DNS responses from the network and is the resolver every process on the host trusts
Products and areas
-
The configuration parsers as a set: unit files, sysusers, tmpfiles and credentials, wherever a specifier, path or permission becomes a privileged action
Products and areas
-
The sandboxing and hardening directives, ProtectSystem, PrivateTmp and the seccomp integration, which are a security control in their own right
Products and areas
-
udev and its rule engine, where device attributes supplied by attached hardware drive rule matching and helper execution
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Attacks that assume the attacker is already root, which sits outside the boundary systemd is defending
-
Configuration arguments about upstream defaults, such as which units are enabled or how a hardening directive is set, which are policy rather than a defect
-
Defects that actually live in the kernel, dbus-daemon, polkit or glibc rather than in systemd itself
-
Distribution packaging and downstream patches: unit files or defaults a distribution ships that upstream systemd does not
-
One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, including crashes that come from resource exhaustion
-
Patches the maintainers decline, patches under one month or over twelve months old, and anything past three submissions a person a month
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under systemd.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.