TinyUSB bug bounty programs

TinyUSB programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
TI TinyUSB Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• TI

  TinyUSB

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://docs.tinyusb.org/en/latest

  Web

• Endpoint buffer management, and the DCD and HCD portability layer between the stack and each silicon vendor's controller

  Products and areas

• Reports go in as GitHub Security Advisories on hathach/tinyusb, and upstream is the boundary: a vendor SDK copy or a downstream port counts only when the defect is in the upstream tree. Everything in that tree is in play

  Products and areas

• The class driver set as a whole: CDC-ACM, MSC and its SCSI command handling, HID, Audio, Video, DFU and the vendor class

  Products and areas

• The device stack in full: SETUP packet parsing and the dispatch of standard, class and vendor control requests

  Products and areas

• The DFU class specifically, a direct firmware-write primitive and the highest-consequence driver in the tree

  Products and areas

• The host stack in full, including configuration, interface, endpoint and HID report descriptor parsing, all of it read from a device the host has no reason to trust

  Products and areas

• The per-port glue for the boards and silicon families the tree supports, where a shared abstraction is implemented once per controller

  Products and areas

No target matches. Try part of a host name, such as the company name.