- Scope
- 9
- First response
- –
- Top severity
- High
Open source
Ecosystem Global Updated
Sorona is an open-source bug bounty platform with 475 public programs; 475 (100%) pay cash, with a median top reward of $1,500 and a highest of $1M.
Paid bounties on open-source projects. Sorona pays where a project has no bounty of its own, and many programs let you take a Low finding as cash or a Claude Max subscription.
What matters most when you are new: rewards for small bugs, open access and quick answers.
The usual complaints about bug bounty platforms, and what the data says here.
Triage speed
Median first response is 3 days.
Low-severity bugs
371 programs list a cash reward for Low. 27 start at Medium or higher. 77 publish one top amount instead of a table, so Low isn't stated.
Rewards beyond cash
272 programs let you take a Low finding as cash or a Claude Max subscription instead.
Identity checks (KYC)
39 require KYC before paying, 2 say they don't; the rest don't say.
Fees and deposits
No program here lists a fee or deposit per report.
How you are paid
461 pay in fiat money and 14 in crypto.
Safe harbor
1 state full safe harbor and 474 partial.
Open source
Open source
Open source
Open source
Open source
No KYC Open source
Maximum reward per severity, from USD reward tables.
| Severity | Programs | Median | Top |
|---|---|---|---|
| Critical | 61 | $10k | $101k |
| High | 99 | $3,750 | $1M |
| Medium | 100 | $1,125 | $50k |
| Low | 364 | $100 | $10k |
Search and filter without leaving the page. Filters stay in the link, so you can share a view.
No KYC Open source
No KYC Open source