VideoLAN bug bounty programs

VideoLAN programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
VM VLC media player Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• VM

  VLC media player

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.videolan.org/vlc

  Web

• Every decoder module and the codec integration layer that hands parsed frames across into them

  Products and areas

• The access and stream-input modules in full: HTTP, RTSP, HLS, SMB and every other network path where the untrusted bytes arrive without a file ever being saved

  Products and areas

• The libVLC embedding API used by third-party applications, which exposes the same parsers inside other software

  Products and areas

• The subtitle parsers as a set, SSA and ASS, SRT and WebVTT included. A repeat offender, because a subtitle file arrives as plain text nobody inspects

  Products and areas

• The whole demux and mux layer, covering MP4, MKV, AVI, TS, Ogg, ASF and the long tail of formats behind them. Historically the richest bug source in the codebase

  Products and areas

• VideoLAN takes security reports at [email protected], the address OSS-Fuzz also lists as the project's primary contact. The covered artefact is the upstream VLC tree and libVLC, rather than forks, repackagings or VideoLAN's web properties

  Products and areas

No target matches. Try part of a host name, such as the company name.