- Top reward
- $1,875
- Top severity paid
- High
- Assets in scope
- 11
- Public CVEs
- 4
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,875
- for high bugs, from $313.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 10 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| High |
|
$1,875 |
| Medium |
|
$938 |
| Low |
|
$313 |
- Response
-
Within 10 days
10 business days First response
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 6 excluded.
Web 1
- https://github.com/cloudflare/circl
Products and areas 10
- Classical key exchange and signatures: X25519, X448, Ed25519, Ed448, FourQ, and the P-384 and Goldilocks curve arithmetic beneath them
- Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/circl is covered by that asset and again by Open source tools from Cloudflare, and it is absent from the short list of repositories Cloudflare marks ineligible, so the library is in scope as a whole
- Encoding and decoding of keys, ciphertexts and signatures, which is the part of every scheme a remote peer feeds directly
- HPKE and the KEM, KDF and AEAD combinations it exposes
- OPRF and VOPRF, the primitive under Privacy Pass, including the verification step
- Pairing-based cryptography on BLS12-381, covering the group operations, the pairing itself and the signature schemes built on it
- The field arithmetic, big-integer routines and assembly-optimised backends underneath all of the above, where a carry or reduction mistake becomes a key-recovery bug
- The hybrid X25519 plus post-quantum key exchange Cloudflare runs in production TLS
- The post-quantum KEMs and signature schemes: ML-KEM/Kyber, ML-DSA/Dilithium, the Ed25519 and Ed448 hybrid signature variants, and the SIKE code the library historically carried
- Threshold and blind-signature schemes, together with the zero-knowledge proof helpers they depend on
Out of scope (6)
- Draft-protocol reference implementations and IETF interop endpoints, which the program calls out as Informational only
- Findings submitted without a working proof of concept
- Hardening or standards-deviation findings with no demonstrated impact
- Reports against code paths Cloudflare does not run in production and that have no documented production usage
- Severity cap to plan around: the org-wide open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org
- Timing observations presented on their own, without a demonstrated recovery of key material or other security consequence
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards.
-
A working proof of concept is mandatory: no PoC, no bounty
-
Constant-time and side-channel findings need a demonstrated security impact, not just a measured timing delta
-
Code paths Cloudflare does not run in production and that have no documented production usage will not carry a bounty, so name where the primitive is actually deployed
-
Draft-protocol reference implementations and IETF interop endpoints inside the repo are explicitly Informational only
-
Pin the finding to a released version; CIRCL is at v1.6.4 and actively pushed, so a stale checkout will be closed as already fixed
Not accepted
-
Findings submitted without a working proof of concept
-
Hardening or standards-deviation findings with no demonstrated impact
-
Reports against code paths Cloudflare does not run in production and that have no documented production usage
-
Draft-protocol reference implementations and IETF interop endpoints, which the program calls out as Informational only
-
Timing observations presented on their own, without a demonstrated recovery of key material or other security consequence
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 4 CVEs, 2 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (open-source row bound to github.com/cloudflare) │ $3,500 │ $4,375 High │ $1,500 │ $1,875 Medium │ $750 │ $938 Low │ $250 │ $313 Submit a vulnerability CVE history 2 Last 12 months 4 Lifetime Memory safety 30 % Info disclosure 30 % Parsing/validation 25 % Auth bypass 10 % Latest advisories Loading the feed Overview CIRCL is the post-quantum cryptography implementation Cloudflare deploys across its own edge, and it has become the Go ecosystem's most used third-party source of post-quantum and advanced primitives, pulled in by Privacy Pass implementations, quic-go-adjacent stacks and a widening set of PQ-migration projects. Its reach is rising unusually fast because of where it sits: as post-quantum mandates land, a CIRCL defect propagates into exactly the deployments organisations are migrating to precisely because they believe them safer. The library is at v1.6.4 and actively pushed, so it clears Cloudflare's abandoned-code and 0.x exclusions, and its use in production post-quantum TLS gives it a strong production nexus. Cloudflare pays it on the open-source row, $250 at Low up to $3,500 for a Critical, and sorona.xyz adds 1.25x on top of whatever Cloudflare awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 10 business days First response 10 business days after first response Triage 10 business days after triage Bounty In scope Cloudflare declares its open-source scope org-wide: any Cloudflare-published project under github.com/cloudflare is bounty-eligible on the Tier 2 open-source row, capped at $3,500 for a Critical. cloudflare/circl is covered by that asset and again by Open source tools from Cloudflare , and it is absent from the short list of repositories Cloudflare marks ineligible, so the library is in scope as a whole The post-quantum KEMs and signature schemes: ML-KEM/Kyber, ML-DSA/Dilithium, the Ed25519 and Ed448 hybrid signature variants, and the SIKE code the library historically carried The hybrid X25519 plus post-quantum key exchange Cloudflare runs in production TLS Classical key exchange and signatures: X25519, X448, Ed25519, Ed448, FourQ, and the P-384 and Goldilocks curve arithmetic beneath them Pairing-based cryptography on BLS12-381, covering the group operations, the pairing itself and the signature schemes built on it OPRF and VOPRF, the primitive under Privacy Pass, including the verification step Threshold and blind-signature schemes, together with the zero-knowledge proof helpers they depend on HPKE and the KEM, KDF and AEAD combinations it exposes The field arithmetic, big-integer routines and assembly-optimised backends underneath all of the above, where a carry or reduction mistake becomes a key-recovery bug Encoding and decoding of keys, ciphertexts and signatures, which is the part of every scheme a remote peer feeds directly Out of scope Findings submitted without a working proof of concept Hardening or standards-deviation findings with no demonstrated impact Reports against code paths Cloudflare does not run in production and that have no documented production usage Draft-protocol reference implementations and IETF interop endpoints, which the program calls out as Informational only Timing observations presented on their own, without a demonstrated recovery of key material or other security consequence Severity cap to plan around: the org-wide open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org Most-valued findings Memory-safety violations reachable from attacker-supplied ciphertext, signature or public-key bytes, which is the highest-severity class in a library parsed by network peers Key or plaintext recovery from a side channel where you can show the recovery rather than only the leak, including against the hybrid PQ constructions in production TLS Malformed-input handling in KEM decapsulation, signature verification or point decoding that accepts values the specification requires be rejected Verification bypasses in VOPRF, threshold or blind-signature schemes that let a forged or unauthorised output be accepted Nonce, randomness or state-reuse defects in signature schemes that expose the private key across two ordinary operations Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A working proof of concept is mandatory: no PoC, no bounty Constant-time and side-channel findings need a demonstrated security impact, not just a measured timing delta Code paths Cloudflare does not run in production and that have no documented production usage will not carry a bounty, so name where the primitive is actually deployed Draft-protocol reference implementations and IETF interop endpoints inside the repo are explicitly Informational only Pin the finding to a released version; CIRCL is at v1.6.4 and actively pushed, so a stale checkout will be closed as already fixed Program stats 376 Reports resolved $568k Bounties paid 77% Response efficiency Disclosure Coordinated with Cloudflare through HackerOne on a bounded clock: a report's details stay unpublished for 90 days from submission unless Cloudflare approves otherwise in writing, and the policy names conference talks, blog articles, videos and social media among the channels it covers. Hold the finding until Cloudflare confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability