Aiven open-source repositories

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz P1: Critical (Aiven Open Source Repositories target group) │ $1,000 - $1,500 │ $1,250 - $1,875 P2: High │ $500 - $1,000 │ $625 - $1,250 P3: Medium │ $250 - $500 │ $313 - $625 P4: Low │ $50 - $250 │ $63 - $313 Submit a vulnerability CVE history 4 Last 12 months 6 Lifetime Access control 35 % Info disclosure 25 % Injection 20 % Denial of service 15 % Latest advisories Loading the feed Overview Aiven's open-source estate is the operational machinery underneath managed PostgreSQL, MySQL and Kafka: PGHoard and pglookout for PostgreSQL backup and failover, MyHoard for MySQL, Karapace as the Kafka schema registry and REST proxy, Astacus for cluster backup, and rohmu as the object-storage abstraction they all write through. It is narrow by GitHub-stars standards and structurally important by every other measure: PGHoard and pglookout are used well beyond Aiven, and a defect in PGHoard or rohmu is a defect in the path that holds every backup of a production PostgreSQL cluster. These are credential-handling, backup-restoring, object-storage-writing daemons, so the interesting bugs are rarely memory corruption and usually a service account reaching something it should not. Aiven Ltd pays for reports through its Bugcrowd managed program, where the Aiven Open Source Repositories target group is priced separately from the managed services: P1 pays $1,000 to $1,500 and P4 pays from $50. The $50 to $25,000 headline on the program page belongs to the SaaS tiers, not to this code. sorona.xyz adds 1.25× on top of whatever Aiven awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope What the program declares: vulnerabilities in Aiven open source code, with two targets listed, github.com/Aiven-Open and github.com/Aiven, priced under the Aiven Open Source Repositories target group at P1 $1,000 to $1,500 All of github.com/Aiven-Open. The target is the organisation, so every open-source repository it holds is covered rather than a shortlist of the well-known ones github.com/Aiven, the legacy organisation, listed as the second target PGHoard and pglookout, the PostgreSQL backup and failover daemons, including the archive and restore paths and the failover logic that decides which node becomes primary MyHoard for MySQL backup, Astacus for cluster-wide backup, and rohmu, the object-storage abstraction all of them write through Karapace, the Kafka schema registry and REST proxy, Klaw, the Kafka governance portal, and the KIP-405 tiered-storage plugin, each of which sits inside the in-scope organisation and has its own page here aiven-db-migrate, aiven-extras, journalpump and the Aiven Kubernetes Operator, which run with elevated rights against live database clusters Out of scope github.com/Aiven-Labs, which the program lists explicitly as out of scope even though it is an Aiven organisation Vulnerabilities inherited from an upstream project that Aiven forked, which the program directs upstream rather than paying for Application-level denial of service and physical security, excluded by the program's VRT baseline for every target Third-party-hosted Aiven properties such as Calendly, Qualified, Salesforce, Zendesk and the contact form Customer-created services inside aivencloud.com that the researcher did not create themselves Rate-limiting findings, raw scanner output, and third-party software issues whose patch has been available for less than 30 days Most-valued findings Access-control failure in a daemon that fronts a production database: a service account, operator path or API reaching a cluster or a backup it was never meant to touch. That is the largest recorded bug class here at 35% and the shape that reaches P1. Credential exposure through rohmu or the backup daemons, with object-storage keys, database passwords or encryption material leaking into logs, error output, temporary files or the archive itself A restore-path defect in PGHoard, MyHoard or Astacus where attacker-influenced archive content changes what gets written back into a live cluster Command or SQL injection in the operational daemons and in aiven-db-migrate, where the input crossing into a shell or a privileged connection came from configuration or metadata rather than from an operator Failover logic in pglookout that an attacker can steer, since choosing the primary is the one decision in that daemon with cluster-wide consequences Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only github.com/Aiven-Open and github.com/Aiven are in scope; github.com/Aiven-Labs is explicitly listed out of scope A bug inherited from an upstream project that Aiven forked is not eligible here and has to go upstream to that project instead Test accounts must be created with @bugcrowdninja.com addresses Automated submission is prohibited: there must be a human in the loop on every report The program's $50 to $25,000 headline belongs to the managed-service tiers; open-source code tops out at $1,500, so price the work against that The program acknowledged a volume-related reward backlog on 21 July 2026, so expect payment to lag validation Disclosure Coordinated through Bugcrowd, with expedited triage and validation inside four days for most submissions. Because Aiven will not accept an issue that reached it through any other channel first, file with Aiven through Bugcrowd directly rather than letting the finding travel any other route, and hold the detail until they have shipped a fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability