Tekton bug bounty programs

Tekton programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
TE Tekton Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	3 days promised	Open

• TE

  Tekton

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://tekton.dev

  Web

• Parameter substitution and variable interpolation, which places user-supplied strings into container commands, arguments, scripts, environment variables and image references

  Products and areas

• Remote resolvers that fetch Task and Pipeline definitions from git, from an OCI bundle, from a cluster or from a hub

  Products and areas

• Service account and credential handling, including the docker and SSH credential initialisation that writes config into the step containers

  Products and areas

• Sidecars, their lifecycle and the shared process and volume space with steps

  Products and areas

• Tekton Chains: provenance generation, the signing keys it uses, the attestation formats it emits and where it stores them

  Products and areas

• Tekton Triggers end to end: the EventListener, every interceptor including the GitHub, GitLab, Bitbucket and CEL ones, TriggerBindings and TriggerTemplates

  Products and areas

• The admission webhooks and the defaulting, conversion and validation they perform on Tekton resources

  Products and areas

• The entrypoint binary injected into every step, the step ordering it enforces and the wait and post files it uses to do so

  Products and areas

• The pipeline controller and every pod specification it generates from a Task, a TaskRun, a Pipeline or a PipelineRun

  Products and areas

• The published process asks for private reports to [email protected] with advisories on a ninety-day timeline, and declares no boundary narrower than the Tekton projects. Everything below sits inside that

  Products and areas

• The results API and the storage of run history

  Products and areas

• The Tekton Dashboard, the API behind it and the logs and resources it exposes

  Products and areas

• The webhook signature validation the git provider interceptors perform, which decides whether an event is genuine

  Products and areas

• Workspaces, their volume sources, the subPath handling and the isolation between concurrent runs sharing a workspace

  Products and areas

No target matches. Try part of a host name, such as the company name.