- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 16
- Public CVEs
- 66
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 10 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 10 days
The published process states a ten to fifteen day response window and a three-month escalation path.
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
16 assets you may test, 6 excluded.
Web 1
- https://frappeframework.com
Products and areas 15
- Authentication across every backend the framework ships: password login, API keys and secrets, OAuth2 provider mode, LDAP, SAML and social login
- Background jobs, the scheduler and the socketio realtime layer
- Bench, site configuration and the app installation mechanism that adds code to a running site
- File and attachment handling: upload, the private and public file split, and the access check on download
- Server scripts and client scripts, the mechanism by which an administrator's stored configuration becomes executed code
- Session management, the two-factor implementation and the rate limiting in front of login
- The doctype layer and the ORM built on it: document creation, validation, saving, submission and cancellation, and the hooks applications attach to each stage
- The email inbox, outgoing mail and the notification system
- The Jinja templating used for print formats, notifications, web pages and email, the framework's main server-side template evaluation surface
- The permission engine in full, covering role permissions, user permissions, document sharing, permission levels on individual fields and the owner and if_owner rules
- The policy points every report at the frappe.io/security intake and states no component boundary, so the whole framework is in scope, including everything an application inherits from it
- The query builder and the report engine, including query reports where an administrator supplies raw SQL and the list-view filters that build queries from user parameters
- The REST resource API over doctypes, which exposes create, read, update and delete on any document type to an authenticated consumer
- The website and portal layer, including web forms, web pages and every route the framework serves to an unauthenticated visitor
- The whitelisted-method RPC surface reachable at /api/method, which is how the desk interface and every client call into the server
Out of scope (6)
- A role or user permission an administrator granted deliberately
- Bench and deployment configuration choices, including a site run without the documented hardening
- Defects in ERPNext or in another Frappe application's business logic, which belong on that application's own entry
- Server scripts written by an administrator on a site where server scripting was intentionally enabled, unless the framework's own sandboxing is what fails
- Third-party and custom apps installed on a site, which are other authors' code
- Upstream Python and JavaScript dependency issues, unless Frappe's own use of the dependency is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report through frappe.io/security, the intake both Frappe repositories point at
-
GitHub private vulnerability reporting is disabled on frappe/frappe, so the advisory button is not available here
-
Hold to it before considering public disclosure
-
Say clearly that the defect is in the framework rather than in one app.
-
Name the doctype, the whitelisted method and the role your reproduction started from.
Not accepted
-
Defects in ERPNext or in another Frappe application's business logic
-
Third-party and custom apps installed on a site
-
A role or user permission an administrator granted deliberately
-
Upstream Python and JavaScript dependency issues, unless Frappe's own use of the dependency is what makes the defect reachable
-
Bench and deployment configuration choices
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 35 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 66 CVEs, 43 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 43 Last 12 months 66 Lifetime Access control 40 % Injection 25 % Info disclosure 20 % XSS 15 % Latest advisories Loading the feed Overview Frappe is the Python and JavaScript runtime that ERPNext, Frappe HR, Helpdesk, Insights and CRM are all built on, so a defect in the framework is a defect in every application sitting on top of it at once. That blast radius is the reason to look one layer down rather than at a business module. Frappe published forty-three security advisories in the last twelve months out of sixty-six in its entire history, the busiest unpaid pipeline in this category. Intake is the same email form the whole Frappe estate uses, with a stated response window and no reward tier of any kind. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy points every report at the frappe.io/security intake and states no component boundary, so the whole framework is in scope, including everything an application inherits from it The doctype layer and the ORM built on it: document creation, validation, saving, submission and cancellation, and the hooks applications attach to each stage The permission engine in full, covering role permissions, user permissions, document sharing, permission levels on individual fields and the owner and if_owner rules The whitelisted-method RPC surface reachable at /api/method, which is how the desk interface and every client call into the server The REST resource API over doctypes, which exposes create, read, update and delete on any document type to an authenticated consumer The query builder and the report engine, including query reports where an administrator supplies raw SQL and the list-view filters that build queries from user parameters The Jinja templating used for print formats, notifications, web pages and email, the framework's main server-side template evaluation surface Server scripts and client scripts, the mechanism by which an administrator's stored configuration becomes executed code Authentication across every backend the framework ships: password login, API keys and secrets, OAuth2 provider mode, LDAP, SAML and social login Session management, the two-factor implementation and the rate limiting in front of login The website and portal layer, including web forms, web pages and every route the framework serves to an unauthenticated visitor File and attachment handling: upload, the private and public file split, and the access check on download Background jobs, the scheduler and the socketio realtime layer The email inbox, outgoing mail and the notification system Bench, site configuration and the app installation mechanism that adds code to a running site Out of scope Defects in ERPNext or in another Frappe application's business logic, which belong on that application's own entry Third-party and custom apps installed on a site, which are other authors' code A role or user permission an administrator granted deliberately Server scripts written by an administrator on a site where server scripting was intentionally enabled, unless the framework's own sandboxing is what fails Upstream Python and JavaScript dependency issues, unless Frappe's own use of the dependency is what makes the defect reachable Bench and deployment configuration choices, including a site run without the documented hardening Most-valued findings Anything in the permission engine, since every application on the runtime delegates authorisation to it and one bypass is a bypass everywhere. Permission-level field checks and if_owner rules are the parts most often applied inconsistently Whitelisted methods reachable without the role or the document permission they assume, the most direct way to turn an authenticated low-privilege session into arbitrary document access REST API paths that act on a doctype without applying the checks the desk interface applies, the classic gap in this architecture Server-side template injection in the Jinja layer, where a print format, notification template or web page reaches Python execution SQL injection through query reports, list filters, sort parameters or the query builder, since every application's list views funnel through the same code Server script and client script sandboxing, where an administrator-level feature escapes into full code execution on the host The private and public file split, and any download route that returns an attachment without the owning document's permission check Authentication backend defects, identity binding above all, since attaching an attacker-controlled identity to an existing account takes the whole site with it Web forms and the portal layer, the framework's unauthenticated surface, where a defect is reachable from the open internet with no account at all Background job and scheduler paths that execute with elevated privilege on data a low-privilege user supplied Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through frappe.io/security, the intake both Frappe repositories point at GitHub private vulnerability reporting is disabled on frappe/frappe, so the advisory button is not available here The published process states a ten to fifteen day response window and a three-month escalation path. Hold to it before considering public disclosure Say clearly that the defect is in the framework rather than in one app. A framework finding is larger than an ERPNext finding and should be triaged as such, so make the distinction explicit in the first paragraph Name the doctype, the whitelisted method and the role your reproduction started from. Frappe's authorisation is applied per method and per document, so a report without those cannot be reproduced Recognition is the only thing offered in return; there is no reward tier and no payment to negotiate Disclosure Coordinated privately through the Frappe security intake and published as a GitHub Security Advisory once a fix ships. The process page states a ten to fifteen day window for a first response and a three-month escalation path. At forty-three advisories a year the pipeline is visibly attended and moving, so the practical embargo is set by the next framework release. Remember that every Frappe application inherits the fix on its own upgrade schedule, so real-world exposure outlasts the advisory by a long way. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability