Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

X.Org bug bounty programs

x.org Updated

X.Org runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program X.Org runs.

  • X.Org Server

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://www.x.org

    Web

  • Authentication and access control: the MIT-MAGIC-COOKIE path, Xauth file handling, the host access list and the SECURITY extension's trusted and untrusted client model

    Products and areas

  • Client isolation as the server enforces it, including grabs, selections, the cut buffer and primary selection, and what one client can read or inject into another

    Products and areas

  • Configuration parsing, xorg.conf and xorg.conf.d handling, module and driver loading, and log file handling on the privileged path

    Products and areas

  • Every server extension. The majority of this project's severe defects have historically lived there: XKB, RENDER, RANDR, XFIXES, DAMAGE, COMPOSITE, GLX, DRI, XVideo, SHM, Xinerama, SECURITY and the input extensions are all in

    Products and areas

  • Font handling and the font path, including remote font servers where they are still configured

    Products and areas

  • Input handling end to end: XInput and XI2, device hotplug, keymap and XKB handling, and event delivery between clients

    Products and areas

  • Server-side helper paths that touch the filesystem or spawn processes while privileged

    Products and areas

  • The core protocol implementation in dix: request dispatch, resource management, window and pixmap handling, and the atom and property machinery

    Products and areas

  • The GLX and direct rendering boundary as the server implements it, covering what a client can drive through it

    Products and areas

  • The X.Org security team asks for security issues in the X.Org codebase and draws no line narrower than that, so everything below is inside the declared scope

    Products and areas

  • The Xorg DDX in hw/xfree86: driver loading, mode setting, the setuid startup path and everything the server does before it drops privilege

    Products and areas

  • Xwayland and Xnest and Xvfb as DDX targets in the same repository, subject to the ChromeOS caveat above

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Configuration an administrator chose deliberately, including running xhost + or enabling TCP listening

  • Distribution packaging and distro-specific patches rather than the upstream xserver tree

  • Mesa and libdrm, both paid: Mesa is named verbatim in the Chrome Browser VRP and both ship in the ChromeOS overlays

  • Proprietary GPU drivers and vendor DDX modules, which belong to those vendors

  • The inherent design of X11 client isolation. That any client can read any other client's input by design is a known property of the protocol and not a reportable defect

  • The X11 client libraries. libX11, libXext, libXi, libXrandr, libxcb and the rest are separate repositories and ship in ChromeOS, so they are covered by the ChromeOS VRP and paid there

Recent changes

Reward and scope changes across every X.Org program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under x.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.