Azure SDK for JavaScript

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Auth bypass 35 % Info disclosure 25 % Access control 20 % Injection 15 % Latest advisories Loading the feed Overview This is the Azure client path for JavaScript: @azure/core-rest-pipeline records around 18.3 million npm downloads a week, @azure/identity 13.5 million and @azure/storage-blob 9.0 million, covering Node.js backends, Azure Functions JavaScript workers, Static Web Apps, and a growing amount of browser-side code that authenticates directly against Azure resources. The browser-facing subset is what makes this repository distinct from the Python and .NET SDKs: parts of it run inside a hostile-origin environment where token handling, redirect policy and cross-origin behaviour are directly attacker-adjacent rather than merely internal. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program, where authentication issues top out at $12,000 for a high-quality Critical report and the $15,000 band needs deserialization or code injection. sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of azure/azure-sdk-for-js , which the program names on its SCOPE list under "Azure SDKs, limited to the following", at Critical or Important severity on the most recent actively maintained branch @azure/core-rest-pipeline and the core packages around it: every pipeline policy, the Node and browser HTTP senders, the client-side authentication helpers and the tracing hooks @azure/identity in both runtimes, covering every credential type, the MSAL-backed interactive and broker flows, and the token cache The generated service clients across the whole catalogue, @azure/storage-* , Key Vault, Cosmos, Service Bus, Event Hubs, App Configuration and the rest: request construction, URL and SAS handling, and response model deserialization The browser build of every package that ships one, its cross-origin behaviour, and whatever the bundle exposes to the embedding page The shared core modules that ship inside published packages: @azure/core-util , @azure/core-auth , @azure/abort-controller , @azure/logger and their siblings The repository's own build, release and publish GitHub Actions workflows, which the program prices in a band of their own Out of scope Microsoft and Azure repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing Azure service-side defects, which belong to the Microsoft Azure bounty program Upstream npm dependencies the SDK consumes rather than owns Findings whose impact stays on the local machine, since this repository sits outside the carve-out Microsoft grants to VS Code, Agent Framework, TypeScript, Monaco Editor and PowerShell Moderate and Low severity, which pay $0 at every report quality Samples, tutorials, quickstart code and samples/ directories Hackathon repositories and dependency-confusion reports Publicly disclosed issues Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Prototype pollution or deserialization in the generated client models that a service response can drive into code execution in a Node process: this is the class carrying the $15,000 top band here A credential-flow flaw in @azure/identity , including the MSAL-backed interactive path, that yields a token for an identity or scope the caller was never entitled to, which is the $12,000 authentication-issues band Bearer-token challenge or redirect handling in @azure/core-rest-pipeline that leaks an Azure access token to a host outside the intended endpoint Cross-origin or CORS handling in a browser-targeted client that exposes tokens or resource contents to a hostile origin, the risk that is unique to this SDK among the Azure client libraries SAS token generation or URL construction that produces a credential granting broader access, or a different resource, than the caller requested Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only the repositories listed under "Azure SDKs, limited to the following" qualify; no other Azure repository is covered Azure service-side defects belong to the separate Microsoft Azure bounty program, not this one, so the bug has to live in the client library This repo is not in the local-machine carve-out, so local-machine-only impact is excluded Only Critical and Important severity qualify on the most recent actively maintained branch; Moderate and Low findings pay $0 Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC. Azure SDK fixes are issued through the Microsoft Security Update Guide rather than as repository advisories, with the npm advisory following once fixed packages publish. Microsoft requires bounty submissions stay confidential while it fixes, so file with MSRC yourself first, hold publication until the advisory lands, and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability