Is Sorona a good place to start bug bounty hunting?

371 programs list a cash reward for Low-severity bugs, every program can be read without an account, 71 are known to answer within 3 days and 272 let you take a Low finding as cash or a Claude Max subscription.

Sorona bug bounty programs

Ecosystem Global Updated 1 hour ago

Sorona is an open-source bug bounty platform with 475 public programs; 475 (100%) pay cash, with a median top reward of $1,500 and a highest of $1M.

Paid bounties on open-source projects. Sorona pays where a project has no bounty of its own, and many programs let you take a Low finding as cash or a Claude Max subscription.

Visit sorona.xyz Browse all 475 programs Low bugs: $100 or 1 mo Claude Max

Public programs: 475
Pay cash (100%): 475
Median top reward: $1,500
Highest reward: $1M
First response: 3 d

Is Sorona a good place to start?

What matters most when you are new: rewards for small bugs, open access and quick answers.

371 programs list a cash reward for Low-severity bugs.
Every program can be read without an account.
71 are known to answer within 3 days.
272 let you take a Low finding as cash or a Claude Max subscription.

Pays for Low Fast responders

What hunters should know

The usual complaints about bug bounty platforms, and what the data says here.

Triage speed

Median first response is 3 days.

Based on 109 programs Answer within 3 days
Low-severity bugs

371 programs list a cash reward for Low. 27 start at Medium or higher. 77 publish one top amount instead of a table, so Low isn't stated.

Based on 475 programs Pays for Low
Rewards beyond cash

272 programs let you take a Low finding as cash or a Claude Max subscription instead.

Based on 475 programs Pays for Low
Identity checks (KYC)

39 require KYC before paying, 2 say they don't; the rest don't say.

Based on 41 programs No KYC
Fees and deposits

No program here lists a fee or deposit per report.

Based on 475 programs
How you are paid

461 pay in fiat money and 14 in crypto.

Based on 475 programs Fiat only
Safe harbor

1 state full safe harbor and 474 partial.

Based on 475 programs Full safe harbor

Highest-paying programs

See all

Safe (Safe Smart Account)

safe.global

$1M

Scope

9

First response

–

Top severity

High

Open source
WebKit

webkit.org

$300k

Scope

9

First response

–

Top severity

–

Open source
Chromium

chromium.org

$250k

Scope

10

First response

–

Top severity

–

Open source
kvmCTF (Linux KVM hypervisor)

google.github.io

$250k

Scope

8

First response

–

Top severity

–

Open source
V8

v8.dev

$250k

Scope

10

First response

–

Top severity

–

Open source
Chainlink node

chain.link

$101k
from $125

Scope

8

First response

12 d

Top severity

Critical

No KYC Open source

Rewards by severity

Maximum reward per severity, from USD reward tables.

Severity	Programs	Median	Top
Critical	61	$10k	$101k
High	99	$3,750	$1M
Medium	100	$1,125	$50k
Low	364	$100	$10k

What you can test

4,917 in-scope targets across all programs.

Other 4,442
Web 475

Recent changes

No confirmed changes yet. New programs, scope and reward moves show here once confirmed.

All 475 programs on Sorona

Search and filter without leaving the page. Filters stay in the link, so you can share a view.

Sort

Filters

371 programs match · Highest reward

Programs, highest reward first
Program	Top severity	Scope	First response	Top reward
Safe (Safe Smart Account) safe.global	High	9	–	$1,000,000
Chainlink node chain.link	Critical	8	12 d	$101,000 from $125
Trezor trezor.io	Critical	8	–	$100,000
Swiss Post e-voting crypto-primitives	Critical	9	1 d	€50,000
WordPress wordpress.org	Critical	9	–	$31,200
OP-TEE	Critical	9	–	$20,000
TF-PSA-Crypto	Critical	8	–	$20,000
Trusted Firmware-A trustedfirmware.org	Critical	8	–	$20,000
Trusted Firmware-M trustedfirmware.org	Critical	10	–	$20,000
NVIDIA Container Toolkit	Critical	7	–	$15,000
Shipit Engine	Medium	11	5 d	$15,000 from $1,250
Shopify identity_cache	Medium	10	5 d	$15,000 from $1,250
Shopify job-iteration	Medium	9	5 d	$15,000 from $1,250
CycloneDX Rust Cargo	Critical	8	–	€11,000 from €625
OpenPGP.js openpgp.js	Critical	8	–	€11,000 from €625
Dependabot Core	Critical	9	4 d	$11,000 from $313
ntpd-rs (Project Pendulum)	Critical	7	–	€10,000
Sequoia PGP sequoia-pgp.org	Critical	8	–	€10,000
Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)	Critical	9	–	$10,000
Adobe Commerce Open Source (Magento Open Source)	Critical	9	–	$10,000
Anomalib intel.com	Critical	7	–	$10,000
Arm Mali GPU Kernel Driver arm.com	Critical	8	–	$10,000
Intel Cryptography Primitives Library intel.com	Critical	8	–	$10,000
Intel-maintained open source intel.com	Critical	8	–	$10,000
Intel Neural Compressor intel.com	Critical	8	–	$10,000
Intel Slim Bootloader intel.com	Critical	9	–	$10,000
Kubernetes kubernetes.io	Critical	9	1 d	$10,000
NNCF intel.com	Critical	8	–	$10,000
OpenVINO intel.com	Critical	9	–	$10,000
OpenVINO GenAI intel.com	Critical	8	–	$10,000
OpenVINO Model Server intel.com	Critical	8	–	$10,000
Prow k8s.io	Critical	8	1 d	$10,000
Trust Wallet Core trustwallet.com	Critical	9	–	$10,000
xFasterTransformer intel.com	Critical	8	–	$10,000
MongoDB MCP Server mongodb.com	Critical	11	1 d	$8,500 from $125
Stripe Agent Toolkit stripe.com	High	7	–	$8,500 from $625
Backstage backstage.io	Critical	13	5 d	$8,000
OpenAI Codex CLI openai.com	Critical	9	–	$6,500
Git git-scm.com	High	9	4 d	$6,000 from $313
Luau luau.org	High	9	3 d	$6,000 from $375
New Relic agents newrelic.com	Critical	8	3 d	$6,000
Next.js	High	10	1 d	$6,000 from $625
Nitro nitro.build	High	11	1 d	$6,000 from $625
Nuxt nuxt.com	High	8	1 d	$6,000 from $625
Svelte svelte.dev	High	9	1 d	$6,000 from $625
Turborepo turborepo.com	High	9	1 d	$6,000 from $625
Vercel AI SDK	High	9	1 d	$6,000 from $625
Vercel CLI vercel.com	High	9	1 d	$6,000 from $625
Vercel Workflow workflow-sdk.dev	High	9	1 d	$6,000 from $625
swiyu (Swiss e-ID and Trust Infrastructure)	Critical	8	–	CHF 5,000

Safe (Safe Smart Account)

safe.global

$1M

Scope

9

First response

–

Top severity

High

Open source
Chainlink node

chain.link

$101k
from $125

Scope

8

First response

12 d

Top severity

Critical

No KYC Open source
Trezor

trezor.io

$100k

Scope

8

First response

–

Top severity

Critical

Open source
Swiss Post e-voting crypto-primitives

€50k

Scope

9

First response

1 d

Top severity

Critical

Open source
WordPress

wordpress.org

$31.2k

Scope

9

First response

–

Top severity

Critical

Open source
OP-TEE

$20k

Scope

9

First response

–

Top severity

Critical

Open source
TF-PSA-Crypto

$20k

Scope

8

First response

–

Top severity

Critical

Open source
Trusted Firmware-A

trustedfirmware.org

$20k

Scope

8

First response

–

Top severity

Critical

Open source
Trusted Firmware-M

trustedfirmware.org

$20k

Scope

10

First response

–

Top severity

Critical

Open source
NVIDIA Container Toolkit

$15k

Scope

7

First response

–

Top severity

Critical

Open source
Shipit Engine

$15k
from $1,250

Scope

11

First response

5 d

Top severity

Medium

Open source
Shopify identity_cache

$15k
from $1,250

Scope

10

First response

5 d

Top severity

Medium

Open source
Shopify job-iteration

$15k
from $1,250

Scope

9

First response

5 d

Top severity

Medium

Open source
CycloneDX Rust Cargo

€11k
from €625

Scope

8

First response

–

Top severity

Critical

Open source
OpenPGP.js

openpgp.js

€11k
from €625

Scope

8

First response

–

Top severity

Critical

Open source
Dependabot Core

$11k
from $313

Scope

9

First response

4 d

Top severity

Critical

Open source
ntpd-rs (Project Pendulum)

€10k

Scope

7

First response

–

Top severity

Critical

Open source
Sequoia PGP

sequoia-pgp.org

€10k

Scope

8

First response

–

Top severity

Critical

Open source
Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)

$10k

Scope

9

First response

–

Top severity

Critical

Open source
Adobe Commerce Open Source (Magento Open Source)

$10k

Scope

9

First response

–

Top severity

Critical

Open source
Anomalib

intel.com

$10k

Scope

7

First response

–

Top severity

Critical

Open source
Arm Mali GPU Kernel Driver

arm.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
Intel Cryptography Primitives Library

intel.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
Intel-maintained open source

intel.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
Intel Neural Compressor

intel.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
Intel Slim Bootloader

intel.com

$10k

Scope

9

First response

–

Top severity

Critical

Open source
Kubernetes

kubernetes.io

$10k

Scope

9

First response

1 d

Top severity

Critical

Open source
NNCF

intel.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
OpenVINO

intel.com

$10k

Scope

9

First response

–

Top severity

Critical

Open source
OpenVINO GenAI

intel.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
OpenVINO Model Server

intel.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
Prow

k8s.io

$10k

Scope

8

First response

1 d

Top severity

Critical

Open source
Trust Wallet Core

trustwallet.com

$10k

Scope

9

First response

–

Top severity

Critical

Open source
xFasterTransformer

intel.com

$10k

Scope

8

First response

–

Top severity

Critical

Open source
MongoDB MCP Server

mongodb.com

$8,500
from $125

Scope

11

First response

1 d

Top severity

Critical

Open source
Stripe Agent Toolkit

stripe.com

$8,500
from $625

Scope

7

First response

–

Top severity

High

Open source
Backstage

backstage.io

$8,000

Scope

13

First response

5 d

Top severity

Critical

Open source
OpenAI Codex CLI

openai.com

$6,500

Scope

9

First response

–

Top severity

Critical

Open source
Git

git-scm.com

$6,000
from $313

Scope

9

First response

4 d

Top severity

High

Open source
Luau

luau.org

$6,000
from $375

Scope

9

First response

3 d

Top severity

High

Open source
New Relic agents

newrelic.com

$6,000

Scope

8

First response

3 d

Top severity

Critical

Open source
Next.js

$6,000
from $625

Scope

10

First response

1 d

Top severity

High

Open source
Nitro

nitro.build

$6,000
from $625

Scope

11

First response

1 d

Top severity

High

Open source
Nuxt

nuxt.com

$6,000
from $625

Scope

8

First response

1 d

Top severity

High

Open source
Svelte

svelte.dev

$6,000
from $625

Scope

9

First response

1 d

Top severity

High

Open source
Turborepo

turborepo.com

$6,000
from $625

Scope

9

First response

1 d

Top severity

High

Open source
Vercel AI SDK

$6,000
from $625

Scope

9

First response

1 d

Top severity

High

Open source
Vercel CLI

vercel.com

$6,000
from $625

Scope

9

First response

1 d

Top severity

High

Open source
Vercel Workflow

workflow-sdk.dev

$6,000
from $625

Scope

9

First response

1 d

Top severity

High

Open source
swiyu (Swiss e-ID and Trust Infrastructure)

CHF 5,000

Scope

8

First response

–

Top severity

Critical

Open source