- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 15
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 10 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 10 days
Intake is by email with a stated ten to fifteen day response window
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 6 excluded.
Web 1
- https://erpnext.com
Products and areas 13
- Accounting and the general ledger, including journal entries, payment entries and the reconciliation flows
- Manufacturing, bills of materials, work orders and the subcontracting flow
- Projects, timesheets and assets, plus anything that bills a customer from recorded time
- Server scripts, client scripts and custom workflow, where an administrator's configuration becomes executable behaviour
- Stock, warehouses and the valuation logic that turns movements into financial postings
- The customer and supplier portal, the authenticated but low-privilege surface where an external party views their own documents
- The data import and export tooling, and file attachments on any document
- The permission model as ERPNext configures it: role permissions, user permissions, document-level sharing and the checks applied when one user opens another's record
- The point-of-sale interface and its offline queue, which holds transaction data on a client until it syncs
- The policy points every report to [email protected] and states no component boundary, so the whole ERPNext application set is in scope, on both self-hosted and hosted deployments
- The print and report layer, including custom print formats and query reports that turn user parameters into database work
- The REST API over doctypes, which exposes create, read, update and delete on business records to any authenticated consumer
- The selling and buying cycle end to end: quotations, sales and purchase orders, invoices, delivery notes and receipts
Out of scope (6)
- A role or user permission an administrator granted deliberately
- Defects in the Frappe framework itself, which belong on the Frappe Framework entry and affect every app built on the runtime
- Deployment and bench configuration choices, including a site run without the documented hardening
- Other Frappe applications such as HR, Helpdesk, CRM and Insights, which are separate repositories with their own surfaces
- Third-party and custom apps installed alongside ERPNext on a site
- Upstream Python and JavaScript dependency issues, unless ERPNext's own use of the dependency is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Email the address on the policy page , the address published by the Frappe security policy both repositories point at
-
GitHub private vulnerability reporting is disabled on frappe/erpnext, so the advisory button is not available here
-
The published process states a ten to fifteen day response window and a three-month escalation path. Hold to it before considering public disclosure
-
Decide first whether the defect lives in ERPNext or in the Frappe framework underneath it, and say which in the report. A framework defect affects every app on the runtime and is a different, larger finding
-
Give the exact doctype, the role and the user permissions your reproduction started from. Authorisation in this product is per-document and per-role, so a report without that context cannot be reproduced
-
Recognition is the only thing offered in return; there is no reward tier and no payment to negotiate
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 15 CVEs, 15 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 15 Last 12 months 15 Lifetime Access control 40 % Info disclosure 25 % Injection 20 % XSS 15 % Latest advisories Loading the feed Overview ERPNext is the leading open-source ERP outside the Odoo orbit, running accounting, stock, manufacturing and point of sale for small and mid-sized companies and for a substantial slice of Indian public-sector deployment. It sits on the Frappe framework, so it inherits that runtime's defects and adds its own on top. The record says the code is being looked at hard right now: every security advisory ERPNext has ever published came out in the last twelve months, all fifteen of them. Intake is by email with a stated ten to fifteen day response window, recognition is the only thing on offer, and sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy points every report to [email protected] and states no component boundary, so the whole ERPNext application set is in scope, on both self-hosted and hosted deployments The permission model as ERPNext configures it: role permissions, user permissions, document-level sharing and the checks applied when one user opens another's record Accounting and the general ledger, including journal entries, payment entries and the reconciliation flows The selling and buying cycle end to end: quotations, sales and purchase orders, invoices, delivery notes and receipts Stock, warehouses and the valuation logic that turns movements into financial postings Manufacturing, bills of materials, work orders and the subcontracting flow Projects, timesheets and assets, plus anything that bills a customer from recorded time The point-of-sale interface and its offline queue, which holds transaction data on a client until it syncs The customer and supplier portal, the authenticated but low-privilege surface where an external party views their own documents The REST API over doctypes, which exposes create, read, update and delete on business records to any authenticated consumer Server scripts, client scripts and custom workflow, where an administrator's configuration becomes executable behaviour The print and report layer, including custom print formats and query reports that turn user parameters into database work The data import and export tooling, and file attachments on any document Out of scope Defects in the Frappe framework itself, which belong on the Frappe Framework entry and affect every app built on the runtime Other Frappe applications such as HR, Helpdesk, CRM and Insights, which are separate repositories with their own surfaces Third-party and custom apps installed alongside ERPNext on a site A role or user permission an administrator granted deliberately Upstream Python and JavaScript dependency issues, unless ERPNext's own use of the dependency is what makes the defect reachable Deployment and bench configuration choices, including a site run without the documented hardening Most-valued findings Document-level permission bypass, where a user reads or writes a record their role and user permissions were supposed to exclude. On an ERP this is the difference between a warehouse clerk and the company's full financial history Anything reachable from the customer or supplier portal that returns another party's documents, since the portal is the surface an external, untrusted account already holds credentials for Cross-company data access on a multi-company installation, where one legal entity's ledger reaches another's Server scripts, workflow actions and any other administrator-configurable path that ends in code execution, since an ERP administrator is not usually the same trust level as the server operator Report and print-format handling that evaluates user-supplied template or query content on the server REST API endpoints acting on a doctype without applying the same permission checks the desk interface applies, the classic gap in this architecture The point-of-sale offline queue and its sync path, where transaction data leaves the server's control and comes back Unauthorised retrieval of file attachments, which on this product means invoices, contracts and payslips sitting behind a single access check Stored cross-site scripting in a business record field that later renders in a system manager's session Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] , the address published by the Frappe security policy both repositories point at GitHub private vulnerability reporting is disabled on frappe/erpnext, so the advisory button is not available here The published process states a ten to fifteen day response window and a three-month escalation path. Hold to it before considering public disclosure Decide first whether the defect lives in ERPNext or in the Frappe framework underneath it, and say which in the report. A framework defect affects every app on the runtime and is a different, larger finding Give the exact doctype, the role and the user permissions your reproduction started from. Authorisation in this product is per-document and per-role, so a report without that context cannot be reproduced Recognition is the only thing offered in return; there is no reward tier and no payment to negotiate Disclosure Coordinated privately by email with the Frappe security team and published as a GitHub Security Advisory once a fix ships. The process page states a ten to fifteen day window for a first response and a three-month escalation path, which is more structure than most projects in this category publish. Time disclosure to the patched release rather than to a day count, and account for the hosted Frappe Cloud tenants and self-hosted operators moving at different speeds. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability