Doppler CLI

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (program-wide table) │ $10,000 │ $11,000 High │ $2,500 │ $3,125 Medium │ $750 │ $938 Low │ $250 │ $313 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Info disclosure 40 % Access control 25 % Auth bypass 20 % Code execution 10 % Latest advisories Loading the feed Overview Doppler is one of the three or four secrets managers mid-market engineering organisations actually adopt, and the CLI is the part that runs everywhere: developer laptops, Docker entrypoints, Kubernetes init containers, GitHub Actions and GitLab CI runners, Heroku and Fly.io release commands. Its position makes it inherently high value, because it is the process holding every other credential in plaintext at the moment of injection: a local file-permission or cache bug in this client is a lateral path to the entire secret inventory of whatever it is provisioning. No CVE has ever been published against DopplerHQ/cli , and on a program with forty-three resolved reports that means the reports which landed were against the hosted platform while the open-source client stayed comparatively unexamined. Doppler pays it on HackerOne as a named, individually bounty-eligible source-code asset on a program-wide table running $250 for a low up to $10,000 for a critical. sorona.xyz adds 1.25× on top of whatever Doppler awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 2 business days First response 5 days Triage 14 days Bounty In scope github.com/DopplerHQ/cli as a named SOURCE_CODE asset, bounty-eligible and submission-eligible at a maximum severity of critical and on the program since 2020. Its scope instruction pulls in the Doppler API the client talks to, and the compiled doppler binary is carried as a second bounty-eligible downloadable-executable asset The full command surface: doppler run , doppler secrets , doppler configs , doppler setup and the rest of the tree, along with flag parsing and the config file the CLI maintains Secret fetch, cache and injection, above all doppler run , which puts secrets straight into a child process environment Local credential storage: the token store, the keyring integration, and the permissions the CLI sets on its own config and cache files The TLS and API client: certificate validation, fallback behaviour when the preferred connection path fails, and the handling of whatever the API returns doppler secrets download , template rendering, and every file-writing path that lands plaintext secrets on disk Service tokens, service accounts and the login flow the CLI drives, including the non-interactive auth path used from CI and CD runners Out of scope github.com/DopplerHQ/awesome-bots , marked eligible_for_bounty: false and eligible_for_submission: false . The program discriminates between its own repositories rather than blanket-covering the org The web estate: doppler.com , docs.doppler.com , community.doppler.com and support.doppler.com are all out of scope Denial of service, brute forcing, spamming, social engineering and physical attacks Known-vulnerable dependencies reported without a working proof of concept showing impact through the CLI MFA bypass by way of Google Auth or SAML, which Doppler declares to be intended behaviour Duplicates. First reporter only, and one bounty per underlying root cause however many commands or code paths that cause surfaces on Most-valued findings A CLI-side bug that exposes customer secrets, since the critical rung is explicitly calibrated to secret exposure and that is what carries a finding to $10,000 Local credential or cache files written with permissions that let another user or another container on the same host read the token store Auth bypass in the service-token or service-account path where a token scoped to one project or config reads another's secrets Certificate validation weakness or an insecure fallback in the API client that lets a network position observe or substitute injected secrets Code execution reached through doppler run or template rendering, where a secret value or API response controls what actually gets executed Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Reproducible steps are a precondition of payment, so a report that describes an issue without a path to reproduce it will not be paid regardless of how it is rated First reporter only, and one bounty per underlying root cause no matter how many commands or code paths that cause surfaces on HackerOne accounts must be registered with a [email protected] address, and a researcher may hold at most three of them The disclosure bar is indefinite and reaches resolved issues, so nothing about the report may be discussed outside the program without express written consent from Doppler The bounty table is program-wide rather than per-asset and its critical rung is calibrated to customer-secret exposure, so a CLI-only finding realistically scores lower unless you can show it reaching real secrets Program stats 43 Reports resolved $36k Bounties paid 80% Response efficiency Disclosure Coordinated through Doppler on HackerOne, with no fixed publication clock. The program's terms bar discussing the program or any vulnerability, including ones already resolved, outside the program without Doppler's express consent, so disclosure happens only if and when Doppler agrees to it. sorona.xyz holds your finding until Doppler has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability