delight-im (MovieContentFilter)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical: systemic compromise (XXE, SQL injection, RCE, vertical auth bypass) │ $1,000 │ $1,250 High: full access to another user's private data │ $335 │ $419 Medium: limited access to another user's private data │ $100 │ $125 Low: configuration issues and other limited-impact vulnerabilities │ $35 │ $44 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Latest advisories Loading the feed Overview This is the smallest kind of paying program there is: a single developer, the one behind github.com/delight-im and its 76 public repositories, running a Federacy program over four of their own websites. It earns a listing because one of those websites is moviecontentfilter.com, the declared homepage and reference deployment of delight-im/MovieContentFilter, an AGPL-3.0 project that is not archived, making this the only open-source-adjacent paying program on the platform. Be precise about what that means before you spend time here, because it is the one thing that decides whether your work gets paid. All four in-scope targets are typed as websites rather than repositories, so the scope is hosted instances and this is open-source-by-deployment rather than by repo; a pure source-code finding in the AGPL-3.0 codebase, with nothing demonstrated against the running site, may not qualify at all. The ladder is short and flat: $1,000 for systemic compromise, $335 for full access to another user's private data, $100 for limited access to it, $35 for configuration issues, and the program page prefaces those as typical award amounts for valid reports rather than as guarantees. Disclosure runs through Federacy. sorona.xyz adds 1.25× on top of whatever it awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The program lists four targets and types every one of them as a website: briefe.io, moviecontentfilter.com, undoze.com and delight.im. Those hosted instances are the scope, and there is no repository asset behind them moviecontentfilter.com is the declared homepage and reference deployment of the AGPL-3.0 delight-im/MovieContentFilter, so the open-source code is reachable through the running site rather than as a scope row of its own The whole web application at each of the four hosts: authentication and session handling, the per-user content each one stores, its request handlers and forms, and whatever it exposes to an unauthenticated visitor Out of scope Source-only findings in the AGPL-3.0 repository with nothing demonstrated against a running site, since every in-scope target is typed as a website rather than a repo Any host other than the four the program lists: briefe.io, moviecontentfilter.com, undoze.com and delight.im The rest of delight-im's 76 public repositories and published libraries, none of which appear as a scope row Most-valued findings Systemic compromise of a hosted instance, which the program defines as XXE or SQL injection with significant impact, remote code execution, or vertical authentication bypass. That definition is its $1,000 top band and the only rung paying four figures Full access to another user's private data on moviecontentfilter.com, the IDOR, stored-XSS, CSRF and internal-SSRF shapes the High band names, and the class most likely to exist in a small application that stores per-user content Findings against moviecontentfilter.com rather than the other three sites, demonstrated end to end on the running deployment. It is the one host with published source to reason from, and a live proof is what makes a source-derived bug payable here Limited access to another user's data through reflected XSS or CSRF with demonstrated impact, which is the Medium band and probably the most reachable paying result on this program Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Demonstrate the finding against one of the four in-scope hosted sites: every target is typed as a website, so a source-only report against the AGPL-3.0 repository may not qualify The published figures are prefaced as typical award amounts for valid reports, not as a guaranteed ladder: treat $1,000 as the top of a range rather than a promise There is no submission fee and no identity verification published for this program, so filing costs nothing, but confirm the current terms on the program page before you start This is one developer's program, so read the live Federacy page yourself and expect the scope and the response times of a solo maintainer File through Federacy first and share the finding with no one else until you have read what the program says about publication Disclosure Mediated by Federacy and, in practice, by one developer. Report through Federacy, read the program's own terms on third parties and publication before you involve anyone, and hold the detail until the developer confirms the site is fixed and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability