Xen Project bug bounty programs

Xen Project programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
XP Xen Project Hypervisor Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
XP Xen Project Self-hosted · Disclosure only	–	–	–	–	No cash	None	–	–	Open

• XP

  Xen Project Hypervisor

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• XP

  Xen Project

  Self-hosted · Disclosure only

  Open

  Top reward

  No cash

  Safe harbor

  None

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• support.md

  Domains No bounty

  Covered by Self-hosted

• xenbits.xen.org/docs/unstable/support-matrix.html

  Domains No bounty

  Covered by Self-hosted

• xenproject.org

  Web

  Covered by Sorona, Self-hosted

• http://xenbits.xen.org/gitweb?p=xen.git%3Ba%3Dblob%3Bf%3DSUPPORT.md

  Source code No bounty

  Covered by Self-hosted

• xen.git

  Source code No bounty

  Covered by Self-hosted

• Architecture-specific code for both x86 and Arm, including the Arm SMMU and interrupt controller paths

  Products and areas

  Covered by Sorona

• Device passthrough: the IOMMU code, PCI passthrough, MSI handling and interrupt remapping

  Products and areas

  Covered by Sorona

• Grant tables and event channels, the two shared interfaces every guest is designed to touch

  Products and areas

  Covered by Sorona

• HVM handling in full, including the x86 instruction emulator, viridian enlightenments and nested virtualisation

  Products and areas

  Covered by Sorona

• Memory management across p2m and m2p tables, shadow and hardware-assisted paging, and page reference counting

  Products and areas

  Covered by Sorona

• PV and PVH guest handling, including the PV shim used to run PV guests under an HVM container

  Products and areas

  Covered by Sorona

• The boot path and dom0 construction, plus the hypervisor's own build-time configuration options

  Products and areas

  Covered by Sorona

• The console, debugging and tracing interfaces reachable from a guest or from dom0

  Products and areas

  Covered by Sorona

• The hypervisor core: domain lifecycle, scheduling, and the hypercall interface together with the argument validation applied on every call

  Products and areas

  Covered by Sorona

• The toolstack, covering xl and libxl, libxc and the interface Xen presents to a device model process

  Products and areas

  Covered by Sorona

• The Xen Security Problem Response Process accepts security problems in Xen Project software reported to the security team address, and carves out no component of the hypervisor. Everything below sits inside that

  Products and areas

  Covered by Sorona

• Xen Hypervisor Project

  Products and areas

  Covered by Self-hosted

• xenstore in full, including its transaction handling and the permission model over its nodes

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.