Turborepo bug bounty programs
turborepo.com Updated
Turborepo runs one public program: a Sorona bug bounty paying up to $6,000.
- Top reward
- $6,000
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Turborepo runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Turborepo
Sorona · Bug bounty |
– | $6,000 | $1,250 | $625 | $6,000 | Partial | – | 24 hours promised | Open |
-
- Critical
- –
- High
- $6,000
- Medium
- $1,250
- Low
- $625
- Safe harbor
- Partial
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 8 excluded.
-
https://turborepo.com
Web
-
Artifact integrity: signing, HMAC key handling and the verification step that decides whether a downloaded artifact is trusted
Products and areas
-
Package-graph resolution across npm, pnpm and yarn workspaces, lockfile parsing included
Products and areas
-
The cache itself, local and remote, covering how an artifact is built, uploaded, downloaded and extracted back into a workspace
Products and areas
-
The daemon, its local IPC surface and the file watching it performs across the workspace
Products and areas
-
The published turbo npm packages and the platform binary packages they pull in at install time
Products and areas
-
The remote cache client and its configuration, including the API URL, the token, turbo login and turbo link, and where those credentials land on disk
Products and areas
-
The turbo CLI end to end: turbo.json parsing, task-graph construction, environment-variable handling and the way each task gets invoked
Products and areas
-
The vercel/turborepo repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. Every asset in this program is a GitHub repository, so the target is the repo rather than a hosted cache service
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything that only reproduces in a superseded canary or release-candidate build
-
Asserting that signature:false as a default is itself a vulnerability, without a full poisoning chain built on top of it
-
Cache poisoning that presupposes the attacker already holds remote-cache write access, since that assumes away the interesting half of the bug
-
Examples, templates and documentation snippets rather than Turborepo's own code
-
Findings against Vercel's hosted Remote Cache service, which belong to Vercel's main platform program rather than this open-source one
-
Local-only attacks where the attacker already has filesystem access to the machine running turbo
-
Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity
-
Scanner output, theoretical chains, and unexploited dependency CVEs
Recent changes
Reward and scope changes across every Turborepo program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under turborepo.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.