Valkey bug bounty programs

Valkey programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
VA Valkey Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• VA

  Valkey

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://valkey.io

  Web

• AUTH, TLS termination, certificate handling and the unix socket path

  Products and areas

• CONFIG SET, DEBUG and every command that writes to disk, loads code or changes server behaviour at runtime

  Products and areas

• Every value type and its encodings, including the conversion between compact and full representations for hashes, lists, sets, sorted sets, streams and bitmaps

  Products and areas

• Key expiry, eviction and keyspace notifications, plus the pub/sub implementation and its channel permission checks

  Products and areas

• RDB and AOF file parsing on load, since a server accepts these from restore, from replication and from a rewrite

  Products and areas

• Replication end to end, covering the replica handshake, PSYNC, the RDB transfer and the propagation of writes to replicas

  Products and areas

• SECURITY.md asks for private reports at [email protected] and describes a coordinated process with vendor pre-notification. It sets no boundary narrower than the server the project releases

  Products and areas

• The ACL subsystem: user definitions, command categories, key patterns, channel patterns, selectors and the evaluation that combines them

  Products and areas

• The cluster bus protocol, slot assignment, slot migration and the messages nodes exchange about each other

  Products and areas

• The command dispatch table and the argument parsing of every command in it

  Products and areas

• The Lua scripting engine and the functions engine, their sandboxes, and every library exposed inside them

  Products and areas

• The module API and any modules the project ships, including what a loaded module can reach in the server process

  Products and areas

• The RESP2 and RESP3 protocol parsers, the inline command path and the connection handshake in front of both

  Products and areas

• The Sentinel implementation and the failover decisions it drives

  Products and areas

No target matches. Try part of a host name, such as the company name.