- Top reward
- $1,875
- Top severity paid
- High
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,875
- for high bugs, from $313.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 10 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| High |
|
$1,875 |
| Medium |
|
$938 |
| Low |
|
$313 |
- Response
-
Within 10 days
10 business days First response
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 7 excluded.
Web 1
- https://cfssl.org
Products and areas 10
- Certificate transparency plumbing: SCT submission, retrieval and verification
- Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/cfssl is covered by that asset and again by Open source tools from Cloudflare, and it is absent from the short list of repositories Cloudflare marks ineligible, so the repository is in scope as a whole
- CSR generation and parsing, X.509 and ASN.1 decoding, and the helpers that read PEM and DER supplied by a caller
- Signing itself: the local signer, the remote signer client, profile and policy enforcement, and the certificate a request finally produces
- The auth-key mechanism on the signing API, the check that stands between a network caller and a certificate authority key
- The bundler and its chain construction, the OCSP responder and its revocation answers, and CRL generation
- The certificate database and the queries behind it, where issued certificates and revocation state are recorded
- The CFSSL API server and every endpoint it answers on, including sign, authsign, newcert, newkey, bundle, info, certinfo, init_ca, revoke, ocspsign and health
- The command-line tools shipped with the server, including cfssl, cfssljson and multirootca, and the config and profile files they parse
- The TLS scanning package and the transport helpers that fetch, rotate and validate certificates on a caller's behalf
Out of scope (7)
- Demo, example and test code carried inside the repository
- Duplicates of findings Cloudflare's internal AI-assisted scanning has already produced
- Findings submitted without a working proof of concept, which are ineligible at any severity
- Hardening or standards-conformance issues without a demonstrated security impact
- Self-hosted-only impact with no Cloudflare production nexus or documented production usage
- Severity cap to plan around: the org-wide open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org
- Source-code-only analysis, which the policy rules out however the code reads
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz first.
-
A working proof of concept is mandatory: no PoC, no bounty, and source-code-only analysis is explicitly ineligible
-
Reports affecting only a self-hosted deployment, with no Cloudflare production impact, are not eligible however severe they are locally
-
Cloudflare's internal AI-assisted scanning generates its own findings, and an external report matching one is closed as a duplicate
-
Hardening and standards-conformance observations need a demonstrated security impact attached before they count
-
The last tagged release was March 2024, so anchor the finding to code Cloudflare or a documented deployment still runs
Not accepted
-
Findings submitted without a working proof of concept
-
Source-code-only analysis
-
Self-hosted-only impact with no Cloudflare production nexus or documented production usage
-
Hardening or standards-conformance issues without a demonstrated security impact
-
Demo, example and test code carried inside the repository
-
Duplicates of findings Cloudflare's internal AI-assisted scanning has already produced
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (open-source row bound to github.com/cloudflare) │ $3,500 │ $4,375 High │ $1,500 │ $1,875 Medium │ $750 │ $938 Low │ $250 │ $313 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Parsing/validation 35 % Access control 25 % Injection 20 % Info disclosure 15 % Latest advisories Loading the feed Overview CFSSL is Cloudflare's own PKI and TLS toolkit, and outside Cloudflare it is the certificate-issuance component embedded in a long tail of Kubernetes bootstrap tooling, internal CA setups and CI pipelines that need to mint short-lived certificates; it is the default answer whenever a Go shop decides to roll its own certificate authority. Anything that lets an unauthenticated caller get a certificate signed is a full trust-chain compromise for that deployment, not a single-service bug. Nine thousand stars and zero CVEs in a decade reads as under-researched rather than clean, and the last tagged release was March 2024, so a triager has an abandoned-code argument available. Cloudflare pays it on the open-source row of its public HackerOne program, $250 at Low up to $3,500 for a Critical, and sorona.xyz adds 1.25x on top of whatever Cloudflare awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 10 business days First response 10 business days after first response Triage 10 business days after triage Bounty In scope Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/cfssl is covered by that asset and again by Open source tools from Cloudflare , and it is absent from the short list of repositories Cloudflare marks ineligible, so the repository is in scope as a whole The CFSSL API server and every endpoint it answers on, including sign , authsign , newcert , newkey , bundle , info , certinfo , init_ca , revoke , ocspsign and health Signing itself: the local signer, the remote signer client, profile and policy enforcement, and the certificate a request finally produces CSR generation and parsing, X.509 and ASN.1 decoding, and the helpers that read PEM and DER supplied by a caller The auth-key mechanism on the signing API, the check that stands between a network caller and a certificate authority key The bundler and its chain construction, the OCSP responder and its revocation answers, and CRL generation Certificate transparency plumbing: SCT submission, retrieval and verification The certificate database and the queries behind it, where issued certificates and revocation state are recorded The command-line tools shipped with the server, including cfssl , cfssljson and multirootca , and the config and profile files they parse The TLS scanning package and the transport helpers that fetch, rotate and validate certificates on a caller's behalf Out of scope Findings submitted without a working proof of concept, which are ineligible at any severity Source-code-only analysis, which the policy rules out however the code reads Self-hosted-only impact with no Cloudflare production nexus or documented production usage Hardening or standards-conformance issues without a demonstrated security impact Demo, example and test code carried inside the repository Duplicates of findings Cloudflare's internal AI-assisted scanning has already produced Severity cap to plan around: the org-wide open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org Most-valued findings An unauthenticated or under-authenticated path to getting a certificate signed, which compromises the whole trust chain of any deployment running it and is the top-severity class here Auth-key verification flaws in the signing API, including forgery, replay, or comparison weaknesses that accept a key the CA should reject CSR or X.509 parsing bugs that let a requester smuggle a subject, SAN, or extension past profile enforcement Injection through fields carried from a CSR into issued certificates, bundles, or the database and templates behind them OCSP responder flaws that let a revoked certificate be reported good, or that leak issuance information to an unauthenticated caller Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A working proof of concept is mandatory: no PoC, no bounty, and source-code-only analysis is explicitly ineligible Reports affecting only a self-hosted deployment, with no Cloudflare production impact, are not eligible however severe they are locally Cloudflare's internal AI-assisted scanning generates its own findings, and an external report matching one is closed as a duplicate Hardening and standards-conformance observations need a demonstrated security impact attached before they count The last tagged release was March 2024, so anchor the finding to code Cloudflare or a documented deployment still runs Program stats 376 Reports resolved $568k Bounties paid 77% Response efficiency Disclosure Coordinated with Cloudflare through HackerOne on a bounded clock: nothing from a report may be published, presented or posted for 90 days from submission without prior written approval, and the policy names talks, blogs, videos and social media among the channels it covers. Hold the detail until Cloudflare confirms a fix has shipped and you are clear to publish, or until that window closes. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability