TensorFlow.js bug bounty programs
tensorflow.org Updated Part of Google
TensorFlow.js runs three public programs: a Sorona bug bounty paying up to $3,100, a Sorona bug bounty paying up to $3,100 and a Sorona bug bounty paying up to $3,100.
- Top reward
- $3,100
- Sorona
- Programs
- 3
- 3 pay cash
- Targets in scope
- 28
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
TensorFlow.js
Sorona · Pays the most of the 3 programs: up to $3,100.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
TensorFlow.js
Sorona · Bug bounty |
$3,100 | Partial | – | – | Open |
|
TensorFlow
Sorona · Bug bounty |
$3,100 | Partial | – | – | Open |
|
TensorFlow Serving
Sorona · Bug bounty |
$3,100 | Partial | – | – | Open |
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
28 targets across all 3 programs, each listed once with the programs that cover it. 19 excluded.
-
All of the execution backends the repository ships: WebGL, WebGPU, the CPU backend, and tfjs-backend-wasm with its SIMD kernels, each running in the page's own origin
Products and areas
Covered by TensorFlow.js
-
Deserialisation in tfjs-layers and tfjs-core: model topology, layer classes, custom-object resolution and the config a saved model carries
Products and areas
Covered by TensorFlow.js
-
Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names tensorflow/serving at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70
Products and areas
Covered by TensorFlow Serving
-
Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names tensorflow/tfjs at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70
Products and areas
Covered by TensorFlow.js
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and the tensorflow org contributes five TIER_OT1 rows: tensorflow, serving, models, tfjs and tflite-micro. A product vulnerability anywhere in those repositories is accepted, at $101 to $3,133.70
Products and areas
Covered by TensorFlow
-
Model and checkpoint loading: SavedModel, GraphDef and MetaGraph protobuf parsing, checkpoint restoration, and the function library those files carry
Products and areas
Covered by TensorFlow
-
Repository configuration and the npm release pipeline behind the @tensorflow/* packages, which Google prices under its separate supply-chain category
Products and areas
Covered by TensorFlow.js
-
Repository configuration and the release pipeline behind those images and packages, which Google prices under its separate supply-chain category
Products and areas
Covered by TensorFlow Serving
-
Repository configuration and the release pipelines behind the published packages, which Google prices under its separate supply-chain category
Products and areas
Covered by TensorFlow
-
SavedModel loading from local disk and from remote filesystems (GCS, S3, HDFS) through the TensorFlow filesystem plugins, together with the protobuf graph deserialisation underneath it
Products and areas
Covered by TensorFlow Serving
-
tensorflow/serving model loading and version management, plus the gRPC and REST prediction endpoints it exposes to callers
Products and areas
Covered by TensorFlow
-
tf.io and tf.data: TFRecord reading, the image, audio and text decoders, the dataset pipeline ops, and the filesystem plugins including the remote ones
Products and areas
Covered by TensorFlow
-
tfjs-core itself, meaning the tensor abstraction, dtype and shape validation, and the op and kernel registry every backend dispatches through
Products and areas
Covered by TensorFlow.js
-
tfjs-node and tfjs-node-gpu, the Node bindings to the native TensorFlow C library, where the same inputs become native code on a server
Products and areas
Covered by TensorFlow.js
-
TFLite: flatbuffer model parsing, the interpreter and its built-in ops, and the delegates that hand work to accelerators
Products and areas
Covered by TensorFlow
-
The batching scheduler and its request coalescing, where several callers' requests are merged into a single batch
Products and areas
Covered by TensorFlow Serving
-
The C and C++ API surface exposed by libtensorflow, the Python bindings above it, and the custom-op and delegate registration paths
Products and areas
Covered by TensorFlow
-
The model-loading path end to end: tfjs-converter, the model.json reader and the binary weight-shard fetch, all of which pull from whatever URL the calling page hands the library
Products and areas
Covered by TensorFlow.js
-
The network surface in full: the gRPC PredictionService with Predict, Classify, Regress and MultiInference, the model-status and metadata services, and the REST/HTTP API that fronts all of them
Products and areas
Covered by TensorFlow Serving
-
The runtime under those kernels: the executor and session layer, the Grappler graph optimisation passes, shape inference, resource and variable handling, and the allocators
Products and areas
Covered by TensorFlow
-
The servable and source abstractions the repository exposes for custom loaders, which embedders extend to serve artefacts other than SavedModel
Products and areas
Covered by TensorFlow Serving
-
The servable core: the model server config parser, version policies, the server core and the aspired-versions manager that decide which artefact loads and when one is retired
Products and areas
Covered by TensorFlow Serving
-
The surrounding packages in the monorepo, including tfjs-data and tfjs-react-native, and the conversion and inspection utilities shipped alongside them
Products and areas
Covered by TensorFlow.js
-
The tensorflow_model_server binary itself, its command-line and config surface, and the container images released from this repository
Products and areas
Covered by TensorFlow Serving
-
The whole op kernel surface in tensorflow/core/kernels, reached with tensor shapes, dtypes and attribute values a caller supplies
Products and areas
Covered by TensorFlow
No target matches. Try part of a host name, such as the company name.
Out of scope 19
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Application-level XSS in a site that happens to use TensorFlow.js but whose flaw is in the site's own code
TensorFlow.js
-
Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay
TensorFlow Serving TensorFlow.js
-
Browser engine bugs, which belong to the browser vendor's own program rather than to the library running inside it
TensorFlow.js
-
Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions
TensorFlow.js TensorFlow Serving TensorFlow
-
Denial of service produced by legitimate load, as opposed to a single malformed request that takes the server down
TensorFlow Serving
-
Google repositories the tier file does not name, which sit at OT2 or OT3 and pay nothing for a product vulnerability
TensorFlow.js TensorFlow Serving
-
Loading an intentionally malicious model, where the documentation already warns that models are code
TensorFlow
-
Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch
TensorFlow Serving TensorFlow.js
-
Memory-corruption reports submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch
TensorFlow
-
Model accuracy and adversarial-input research, which is ML robustness rather than a software vulnerability
TensorFlow.js
-
Model-level adversarial-example and ML-robustness research, which is not a software vulnerability
TensorFlow
-
Model-poisoning and adversarial-example research, which is ML robustness rather than a software vulnerability
TensorFlow Serving
-
Operator misconfiguration such as exposing the server to a network without authentication, which is documented behaviour rather than a defect
TensorFlow Serving
-
Other repositories in the tensorflow org beyond the five the tier file lists, which pay nothing for a product vulnerability after the April 2026 rules update
TensorFlow
-
Python-level API misuse by the caller rather than a defect in the framework
TensorFlow
-
Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees
TensorFlow
-
Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue
TensorFlow
-
TensorFlow core kernel bugs, which belong to the TensorFlow entry rather than to the model server
TensorFlow Serving
-
Third-party TensorFlow distributions and vendor forks, which are outside the tier file
TensorFlow
Recent changes
Reward and scope changes across every TensorFlow.js program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under tensorflow.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.