Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Vendure bug bounty programs

vendure.io Updated

Vendure runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
14
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Vendure runs.

  • Vendure

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

14 targets. 6 excluded.

  • https://www.vendure.io

    Web

  • Asset upload and serving, including image transformation on request

    Products and areas

  • Authentication and session handling, covering native and external authentication strategies, session tokens, API keys and the customer verification and password reset flows

    Products and areas

  • Customer data: addresses, order history and stored payment method references

    Products and areas

  • Payment method handlers and the webhook or callback path a gateway uses to report a settled payment

    Products and areas

  • Promotions, discounts, surcharges, tax and shipping calculation, and the order total they produce

    Products and areas

  • The Admin API and every operation a merchant operator can perform through it

    Products and areas

  • The channel and seller model, where one instance serves several storefronts or a marketplace arrangement

    Products and areas

  • The job queue and event bus, where an action on one entity schedules server-side work elsewhere

    Products and areas

  • The order state machine and the active-order mechanism, including the session or token that ties an anonymous cart to a caller

    Products and areas

  • The permission model spanning both APIs: roles, permissions, the customer and administrator boundary and the per-channel restrictions layered over them

    Products and areas

  • The plugin architecture, including how a plugin registers GraphQL extensions, receives configuration and reaches the database

    Products and areas

  • The published policy asks for private reports on Vendure and names no component carve-out, so the whole server is in scope, both APIs included

    Products and areas

  • The Shop API, the anonymous and customer-authenticated GraphQL surface a storefront calls

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A role or channel permission an administrator granted deliberately

  • Community plugins maintained outside the Vendure repository

  • Deployment configuration, including an instance that exposes the Admin API where the documentation advises against it

  • Payment gateway providers' own systems, which are separate estates

  • Storefront code a merchant writes themselves, which is their application rather than Vendure

  • Upstream Node, NestJS and TypeORM dependency issues, unless Vendure's own use of the dependency is what makes the defect reachable

Recent changes

Reward and scope changes across every Vendure program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Vendure products, from the NVD.

Search NVD
  • CVE-2026-25050 Low

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found. The significant timing d

  • CVE-2022-23065 Medium

    In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.

About this page

This page gathers every public program listed under vendure.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.