Vinyl Cache bug bounty programs

Vinyl Cache programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
V/ Varnish / Vinyl Cache Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• V/

  Varnish / Vinyl Cache

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://vinyl-cache.org

  Web

• Ban and purge handling, and the expressions an operator or an API call can submit through them

  Products and areas

• HTTP/1.1 request and response parsing in the daemon, covering request targets in absolute and origin form, framing headers, chunked bodies and connection reuse

  Products and areas

• HTTP/2 support: frame handling, HPACK, stream state, flow control, and the translation into the internal request representation

  Products and areas

• The backend fetch path, including connection reuse to origins and how a backend response is parsed and trusted

  Products and areas

• The cache itself: object keying, hashing, Vary handling and variant selection, which together decide which stored object a request receives

  Products and areas

• The ESI parser and the assembly of edge-included fragments into a response

  Products and areas

• The security page takes reports by direct email to the named maintainers with published GPG keys, and covers the cache itself rather than a named component list. Varnish Software's address is listed alongside and the two sides coordinate on the same issues

  Products and areas

• The shared memory log and the tools that consume it, varnishlog, varnishncsa and the rest

  Products and areas

• The storage engines and their allocation behaviour under adversarial object sizes and counts

  Products and areas

• The varnishd management process, the CLI interface and the authentication on it

  Products and areas

• The VMOD ABI and the VMODs shipped with the project

  Products and areas

• VCL compilation and the C code it generates, and the boundary between operator-authored VCL and the daemon it is compiled into

  Products and areas

No target matches. Try part of a host name, such as the company name.