Woodpecker CI bug bounty programs

Woodpecker CI programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
WC Woodpecker CI Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• WC

  Woodpecker CI

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://woodpecker-ci.org

  Web

• Approval settings for pull requests from forks and from outside collaborators

  Products and areas

• Cron pipelines, manual triggering and pipeline restart, all of which start work outside a forge event

  Products and areas

• Log storage, log streaming and the retention of pipeline output

  Products and areas

• Plugin execution and the privileged plugin allow-list that decides which images may request elevated container settings

  Products and areas

• Secret storage and the rules deciding which secret is available to which repository, event type, branch and plugin image

  Products and areas

• The agent and server protocol, the gRPC connection between them and the shared agent secret that authenticates an agent

  Products and areas

• The execution backends, docker, kubernetes and local, and the container or process configuration each produces from a step definition

  Products and areas

• The forge integrations for Gitea, Forgejo, GitHub, GitLab and Bitbucket, covering the OAuth flow, the tokens produced and how repository permissions are read back

  Products and areas

• The pipeline configuration parser, including when conditions, matrix expansion, the step and service definitions and the substitution of environment values

  Products and areas

• The policy asks reporters not to open a public issue and to email [email protected], with fixes published as GitHub Security Advisories. It declares no boundary narrower than Woodpecker itself

  Products and areas

• The web UI, the REST API behind it and the CLI that uses the same API

  Products and areas

• User and repository permission synchronisation from the forge, including how admin, write and read map into Woodpecker

  Products and areas

• Webhook handling and the signature validation that decides whether an event genuinely came from the forge

  Products and areas

No target matches. Try part of a host name, such as the company name.