HashiCorp bug bounty programs

HashiCorp programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
HV HashiCorp Vault Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• HV

  HashiCorp Vault

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.vaultproject.io

  Web

• Audit devices, their HMAC treatment of sensitive fields and any path that avoids being audited

  Products and areas

• Every auth method the tree ships: AppRole, Kubernetes, JWT and OIDC, AWS, Azure, GCP, LDAP, userpass, TLS certificates, Okta, Radius and GitHub

  Products and areas

• HashiCorp asks for coordinated disclosure at [email protected] and states there is no bug bounty and no monetary reward. The trust page declares no scope narrower than the product itself

  Products and areas

• Identity: entities, aliases, groups, group membership resolution and the identity tokens Vault issues

  Products and areas

• Namespaces and the isolation between them on a multi-tenant server

  Products and areas

• Policy evaluation end to end, covering path matching, wildcards and globs, capability sets, denied paths and the templated policy machinery

  Products and areas

• Response wrapping, the cubbyhole and the unwrap flow, which is how secrets reach workloads

  Products and areas

• The HTTP API in full, including every sys/ endpoint and the operations only a root token should reach

  Products and areas

• The PKI engine specifically: issuance, role constraints, allowed domains and SANs, intermediate signing, and CRL and OCSP handling

  Products and areas

• The plugin system and the loading and verification of external plugins

  Products and areas

• The seal and unseal path, Shamir key shares, auto-unseal through a cloud KMS or HSM, recovery keys and the rekey and rotate operations

  Products and areas

• The secrets engines shipped in the tree, including KV version 1 and 2, database, PKI, transit, SSH, AWS, Azure, GCP, Consul, Nomad, TOTP and Kubernetes

  Products and areas

• The storage backends and exactly what is written to them, plus the barrier encryption in front of that

  Products and areas

• The token store: creation, child and orphan tokens, renewal, revocation, use limits, periodic tokens and the entity binding on each

  Products and areas

• Vault Agent, the Kubernetes sidecar injector, the CSI provider and Vault Secrets Operator where the tree ships them

  Products and areas

No target matches. Try part of a host name, such as the company name.