Trino Software Foundation bug bounty programs

Trino Software Foundation programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
TR Trino Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• TR

  Trino

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://trino.io

  Web

• Authentication in every supported form: password files, LDAP, Kerberos, OAuth2 and OIDC, JWT and certificate-based authentication

  Products and areas

• Catalog configuration handling, including dynamically created catalogs and anything that lets a session influence how a catalog connects

  Products and areas

• Communication between the coordinator and the workers, including the shared secret that is supposed to protect it and what a worker accepts from an unauthenticated peer

  Products and areas

• Every connector the project ships, covering the Hive, Iceberg, Delta Lake, JDBC, object store, message queue and search connectors, along with the credentials and the catalog properties each one holds

  Products and areas

• Plugin and function loading, including user-defined functions and anything else that puts new code on the classpath

  Products and areas

• Spooling, exchange and temporary data handling, including where intermediate results are written and who can read them

  Products and areas

• The access control interface and every implementation shipped or commonly plugged into it, including file-based rules and external policy engines, along with the point at which each check is applied

  Products and areas

• The CLI, the JDBC driver and the client libraries the project publishes

  Products and areas

• The coordinator in full: the client protocol, the statement API, the query lifecycle endpoints and every administrative route it exposes

  Products and areas

• The published policy asks for security vulnerabilities by email to the project address and states no scope carve-out, so the whole Trino tree is in

  Products and areas

• The SQL layer end to end, covering parsing, analysis, planning, optimisation and every built-in function a query can reach

  Products and areas

• The web interface and the query and cluster information it exposes

  Products and areas

No target matches. Try part of a host name, such as the company name.