TYPO3 bug bounty programs
typo3.org Updated
TYPO3 runs two public programs: a Sorona bug bounty and a self-hosted disclosure program with no cash rewards.
- Top reward
- Not published
- Programs
- 2
- 1 pays cash
- Targets in scope
- 13
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
TYPO3
Sorona
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
TYPO3
Sorona · Bug bounty |
€600 (highest) | €300 (highest) | €150 (highest) | €50 (highest) | Not published | Partial | – | – | Open |
|
Typo3
Self-hosted · Disclosure only |
– | – | – | – | No cash | None | – | 2 days promised | Open |
-
- Critical
- €600 (highest)
- High
- €300 (highest)
- Medium
- €150 (highest)
- Low
- €50 (highest)
- Safe harbor
- Partial
-
- Safe harbor
- None
- First response
- 2 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
13 targets across all 2 programs, each listed once with the programs that cover it. 6 excluded.
-
Frontend rendering, covering TypoScript evaluation, Fluid template rendering, the content elements the core ships, and the routing that resolves a page request
Products and areas
Covered by Sorona
-
The backend in full: the user, group and permission model, login and session handling, the install tool, and every module an authenticated editor or administrator can reach
Products and areas
Covered by Sorona
-
The core components that accept visitor input, including the form framework, link handling and redirect handling
Products and areas
Covered by Sorona
-
The database abstraction layer and the query building that core modules and extensions alike go through
Products and areas
Covered by Sorona
-
The extension manager, scheduler and the other core system extensions shipped in a standard distribution
Products and areas
Covered by Sorona
-
The file abstraction layer, its storage drivers, upload handling and the processed-file pipeline
Products and areas
Covered by Sorona
-
TYPO3 CMS core, in the program's own words "all stable versions that are maintained for the TYPO3 community at the time of a vulnerability report are covered". That is the headline declaration and the only reward row that reaches 600 EUR
Products and areas
Covered by Sorona
-
TYPO3-operated infrastructure as a separate and lower-paying row: typo3.org, extensions.typo3.org, my.typo3.org and the Association's ldap, git, review and docs services, at 300 EUR for a Critical, 150 at High, 100 at Medium and nothing at Low
Products and areas
Covered by Sorona
-
Workspaces, versioning and the content staging model, along with the frontend and backend authentication that gate them
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Bounty begging and pressure of any kind, which the Security Team states plainly it will ignore
Sorona
-
Development-only branches and unreleased code, since the scope is limited to released, community-maintained stable versions
Sorona
-
Low-severity infrastructure findings, where the matrix's Infrastructure row leaves the Low cell empty
Sorona
-
Reports from active TYPO3 Association members, who are excluded from rewards by the program's own terms
Sorona
-
Third-party extensions from the TER: the extension column pays zero at every severity, because "financial rewards for extension vulnerability reports end on 31 May 2026". This is the single largest piece of TYPO3's attack surface and it no longer pays
Sorona
-
Versions that have fallen out of community maintenance at the time you report them
Sorona
Recent changes
Reward and scope changes across every TYPO3 program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under typo3.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.