- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 5 days
The policy commits to acknowledging within five days.
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 6 excluded.
Web 1
- https://bun.com
Products and areas 10
- bun install end to end: registry communication, lockfile parsing, tarball extraction, dependency resolution and lifecycle script execution
- bunx and the single-file executable builder, both of which fetch or embed code and then run it
- The built-in HTTP server, the WebSocket server and the fetch implementation, all of which handle input straight off the network
- The bundled SQLite, filesystem, shell and subprocess APIs Bun exposes to JavaScript, and the boundary checks around them
- The bundler and the transpiler, which parse untrusted source and emit code that will later run
- The macro and plugin system, which runs code during a build
- The Node.js compatibility layer, where Bun reimplements node: modules and a semantic difference from Node can become a security difference
- The runtime and its JavaScriptCore embedding, including the native bindings and the Zig code that bridges the engine to the host
- The security policy names a single address and draws no scope boundary at all, so anything the bun binary does is in. The list below is the component surface rather than a carve-out
- The test runner and its module loading, which executes repository code on CI machines
Out of scope (6)
- JavaScriptCore itself, WebKit's engine, which carries its own security process
- Node compatibility gaps with no security consequence, which are ordinary bugs
- npm packages a project installs, unless Bun's own resolution, extraction or script handling is what makes the defect reachable
- Oven's website and hosted infrastructure, since the policy is about the runtime
- Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary
- Zig and LLVM defects in the toolchain that builds Bun, as distinct from Bun's own code
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Pin the Bun version.
-
Say which mode the bug is in: the runtime, bun install , the bundler or the test runner.
-
Reproduce on a clean install rather than inside a project with its own tooling
Not accepted
-
Node compatibility gaps with no security consequence, which are ordinary bugs
-
Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary
-
Zig and LLVM defects in the toolchain that builds Bun, as distinct from Bun's own code
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview Bun is a JavaScript and TypeScript runtime built on JavaScriptCore that also ships a package manager, a bundler and a test runner in the same binary. That second role is where its reach comes from: teams install bun in CI to resolve dependencies and run tests even where production still runs Node. A compromise of that path executes on a machine holding registry tokens and source. The project has published no security advisory yet, so there is no reference CVE and the surface is close to untouched. Oven runs no bounty and bun.com/security does not exist. sorona.xyz pays you directly on qualified, reproduced findings. In scope The security policy names a single address and draws no scope boundary at all, so anything the bun binary does is in. The list below is the component surface rather than a carve-out The runtime and its JavaScriptCore embedding, including the native bindings and the Zig code that bridges the engine to the host The Node.js compatibility layer, where Bun reimplements node: modules and a semantic difference from Node can become a security difference bun install end to end: registry communication, lockfile parsing, tarball extraction, dependency resolution and lifecycle script execution The bundler and the transpiler, which parse untrusted source and emit code that will later run The test runner and its module loading, which executes repository code on CI machines The built-in HTTP server, the WebSocket server and the fetch implementation, all of which handle input straight off the network The bundled SQLite, filesystem, shell and subprocess APIs Bun exposes to JavaScript, and the boundary checks around them bunx and the single-file executable builder, both of which fetch or embed code and then run it The macro and plugin system, which runs code during a build Out of scope JavaScriptCore itself, WebKit's engine, which carries its own security process npm packages a project installs, unless Bun's own resolution, extraction or script handling is what makes the defect reachable Node compatibility gaps with no security consequence, which are ordinary bugs Oven's website and hosted infrastructure, since the policy is about the runtime Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary Zig and LLVM defects in the toolchain that builds Bun, as distinct from Bun's own code Most-valued findings Memory corruption reachable from JavaScript through the native bindings or the Zig layer that bridges JavaScriptCore to the host. Bun has published no advisory, so this class is entirely unmapped Anything in bun install that reaches code execution from a registry response, a crafted tarball or a lockfile. That runs on CI machines holding registry tokens and source Path traversal out of tarball extraction during install, the class that writes files outside the target directory Node compatibility divergences with security weight: a node:crypto , node:fs or permission-adjacent API that accepts something Node rejects Request smuggling, header parsing and WebSocket framing defects in the built-in servers, which are exposed directly to the internet in production deployments Boundary defects in the shell and subprocess APIs, where a string assembled in JavaScript becomes a command Anything in the macro and plugin system that executes attacker code during a build the developer did not intend to be dangerous Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] , the address the project's SECURITY.md names, with a named handler behind it The policy commits to acknowledging within five days. There is no published triage or fix timeline beyond that There is no bounty page. bun.com/security returns a 404 and Oven runs no programme on any platform, so there is nothing upstream to negotiate Pin the Bun version. The 1.3 line moves fast, and a report against a build two weeks old may already be moot Say which mode the bug is in: the runtime, bun install , the bundler or the test runner. They share one binary and have very different threat models For anything in bun install , state whether the malicious input is a registry response, a lockfile or a package script. Only some of those are attacker-controlled in a normal workflow Reproduce on a clean install rather than inside a project with its own tooling, since the report has no advisory precedent to be compared against Disclosure Coordinated by email with a named handler at Oven, the company behind Bun, with a five-day acknowledgement commitment and no published timeline past that. The repository carries no advisory record to read a cadence from, so agree the embargo and the publication date in the thread rather than assuming one. Expect the fix in the next patch release given how fast the 1.3 line moves. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability