Zulip bug bounty programs
zulip.com Updated
Zulip runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 15
- 2 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Zulip
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Zulip
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | 2 days promised | Open |
|
Zulip
Self-hosted · Disclosure only |
– | – | – | – | No cash | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
- First response
- 2 days promised
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
15 targets across all 2 programs, each listed once with the programs that cover it. 6 excluded.
-
Authentication backends: password, LDAP, SAML, OIDC and social login, along with session handling and the invitation flow
Products and areas
Covered by Sorona
-
Channel and direct message access control, covering private channels, the checks applied when a user joins or is added, and guest users, who are the lowest-trust account the product issues
Products and areas
Covered by Sorona
-
File upload and attachment serving, including the access check applied when an attachment URL is requested
Products and areas
Covered by Sorona
-
Integrations and incoming webhooks, the surface that accepts data from external systems and turns it into messages
Products and areas
Covered by Sorona
-
Markdown rendering, link preview generation and any other path where the server fetches a URL a user supplied
Products and areas
Covered by Sorona
-
Message editing, deletion and the moderation controls layered over them
Products and areas
Covered by Sorona
-
Message history visibility rules, including what a newly added member can read and what happens when a channel's policy changes
Products and areas
Covered by Sorona
-
The Electron desktop client, particularly its handling of untrusted message content and its update path
Products and areas
Covered by Sorona
-
The Flutter mobile client, including deep link handling and notification processing
Products and areas
Covered by Sorona
-
The mobile push notification bouncer, which relays notifications on behalf of self-hosted servers
Products and areas
Covered by Sorona
-
The organisation settings and administration surface, including user role changes and the export and import machinery
Products and areas
Covered by Sorona
-
The policy declares its in-scope surface as the Zulip server together with the Electron desktop application and the Flutter mobile application, and takes reports on all three through the same channels. Nothing narrower is carved out
Products and areas
Covered by Sorona
-
The realm boundary on a server hosting several organisations, where a realm is one organisation's whole message history
Products and areas
Covered by Sorona
-
The REST API in full, plus API keys, bot accounts and the bot token model
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
An organisation permission or channel policy an administrator set deliberately
Sorona
-
Public disclosure before the coordinated release, which the policy's process rules out
Sorona
-
Self-hosting and deployment configuration, including a server run against the documented installation guidance
Sorona
-
Testing against live instances holding other organisations' private conversations
Sorona
-
Third-party integrations' own systems, which are separate estates rather than Zulip code
Sorona
-
Upstream Python, Django and JavaScript dependency issues, unless Zulip's own use of the dependency is what makes the defect reachable
Sorona
Recent changes
Reward and scope changes across every Zulip program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Zulip products, from the NVD.
-
CVE-2026-40300 Medium
Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.
-
CVE-2026-40300 Medium
Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.
-
CVE-2026-26058 Medium
Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6.
-
CVE-2026-25742 Medium
Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after
-
CVE-2026-25742 Medium
Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after
-
CVE-2026-26058 Medium
Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6.
-
CVE-2026-24050 Low
Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.
-
CVE-2026-24050 Low
Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.
About this page
This page gathers every public program listed under zulip.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.