Typesense bug bounty programs

Typesense programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
TY Typesense Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• TY

  Typesense

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://typesense.org

  Web

• Clustering and the Raft-based high-availability path, covering node join, the peer configuration and inter-node requests that arrive already trusted

  Products and areas

• Document ingestion and the import path, covering JSON and JSONL parsing, schema validation, auto-schema handling and the write-ahead log

  Products and areas

• Every HTTP endpoint the server exposes, including /multi_search, the single-collection search path, documents, collections, aliases, synonyms, overrides, analytics and the keys API

  Products and areas

• Scoped search key handling end to end, covering signature verification, the embedded filter that constrains a tenant, and any way a client can widen or strip it

  Products and areas

• Search request parsing: filter expressions, faceting, grouping, sorting, vector and hybrid search parameters, and the typo-tolerance machinery itself

  Products and areas

• Snapshot and backup handling, which serialises every collection and every key

  Products and areas

• The API key system in full: the bootstrap key, derived keys, the actions and collection patterns attached to them, expiry and the scoped search keys generated from a parent key

  Products and areas

• The conversational and embedding features, including any outbound request the server makes to a model provider on a user's behalf

  Products and areas

• The official client libraries the project publishes

  Products and areas

• The on-disk store and index format, including anything that reads back state a previous version wrote

  Products and areas

• The published policy asks for any security issue by email to the project security address and draws no component boundary at all. The whole server and the official clients sit inside it

  Products and areas

• The search cache and any other cross-request state, including whether a cached result can be served to a request that was not entitled to it

  Products and areas

No target matches. Try part of a host name, such as the company name.