Gerrit Code Review

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 1 Last 12 months 4 Lifetime Access control 45 % Auth bypass 25 % Info disclosure 20 % XSS 8 % Latest advisories Loading the feed Overview Gerrit is the code review and submit gate for AOSP, Chromium, Go, Fuchsia, Qt, Eclipse, Wikimedia and LineageOS, alongside a long list of large enterprise and telecom engineering organisations. Its footprint is not measured in installs but in what it authorises: Gerrit is the software that decides which commits are allowed to land in Android. That gives it an unusual property for a bug bounty target: an access-control bypass here is functionally a supply-chain compromise of an operating system on billions of devices, and Google's own rules price a supply-chain compromise on a Tier OT1 repository at $1,337 to $13,337 rather than at the $3,133.70 product-vulnerability cap, so how a report is framed can change the award by roughly four times on the same finding. The historical CVEs are permission-bypass and cross-project access issues, which is precisely the class that matters in this codebase, and there is a fresh one in 2026. Google pays for reports through the Open Source Software VRP at Tier OT1, where a product vulnerability runs from $101 to $3,133.70 and a discretionary panel decides where in that band a finding lands. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Gerrit is one of the "selected repositories hosted on other platforms" the program's scope sentence allows for, and the tier file names gerrit.googlesource.com/gerrit at OT1. A product vulnerability in Gerrit's own code is priced at $101 to $3,133.70, with source-integrity compromise falling in the separate $1,337 to $13,337 category Access control: the project, branch and ref-level permission model, All-Projects inheritance, and the visibility checks applied to repositories, changes and comments Submit rules and submit requirements, including Prolog submit rule evaluation and label and approval enforcement, where a bypass lets a change land without the reviews it was supposed to collect The REST API across all of its endpoints, together with the authentication and authorisation layer in front of it, which is what most automation talks to The SSH daemon and Git-over-HTTP and Git-over-SSH transport, including how those transports map a session onto an account Change creation and mutation: refs/for/ magic-branch handling, patch set upload, change edits, cherry-pick and rebase, and the submit strategies that write to a target branch Account, group, e-mail and SSH key management, external ID handling, and the authentication back ends Gerrit ships for OpenID, OAuth, LDAP and container-managed HTTP NoteDb storage, the secondary index, and the caches that answer change and permission queries The web UI and everything it renders, including diffs, comments, file previews and any content a change author controls Plugin loading, the plugin API's access to the permission model, and the plugins bundled in a Gerrit release Replication, the Git protocol implementation, and the download and archive endpoints Out of scope Individual third-party Gerrit plugins that are not shipped in-tree Deployment-specific misconfiguration by the operator, such as permissive All-Projects ACLs JGit issues, which belong upstream to the Eclipse project rather than to Gerrit Self-XSS and anything that requires an administrator account to trigger Reverse-proxy and authentication-frontend configuration the operator chose, rather than what Gerrit itself ships Releases that are not current, and code outside the repository the tier file names: the program covers the latest versions of gerrit.googlesource.com/gerrit , and the GitHub mirror is the same project rather than a second target Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue Most-valued findings A permission-evaluation bypass that lets a user read or write a project, branch or ref they have no grant for: the dominant class in this codebase at 45%, and the finding that should be framed as a source-integrity compromise, where Google's OT1 supply-chain band runs to $13,337 rather than the $3,133.70 product cap A submit-rule or label-enforcement bypass that lands a change without the approvals the project requires, which is the review gate itself failing open Authentication bypass on the REST API, the SSH daemon or Git transport, letting an unauthenticated or wrongly-identified party act as another account refs/for/ and patch set upload handling that lets someone alter a change or push content attributed to a different author or target branch Cross-project information disclosure that exposes the contents of a private repository or an embargoed change to an account without access, the historical shape of this project's CVEs Account, group or e-mail management flaws that let an attacker acquire membership of a group whose permissions they were never granted Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Gerrit is hosted on gerrit.googlesource.com rather than GitHub; it is covered under the rules' language about selected repositories hosted on other platforms, and the GitHub mirror is not a separate target Frame the report accurately: a bug in Gerrit's own code is a product vulnerability capped at $3,133.70, while a finding that amounts to a compromise of source or build integrity is a separate supply-chain category priced from $1,337 to $13,337 Third-party plugins that Gerrit does not ship in-tree are not covered; the defect has to be in Gerrit itself or in a bundled plugin Deployment-specific misconfiguration by the operator, such as a permissive All-Projects ACL, is a configuration choice rather than a vulnerability Self-XSS and anything that requires an administrator account are not eligible, since an administrator is already inside the trust boundary Google's rules state that privately disclosing a flaw to a third party, for any purpose other than fixing it, will typically not qualify for a reward Disclosure Coordinated through Google Bug Hunters, with the fix landing upstream on gerrit.googlesource.com and shipping in a Gerrit release with researcher credit. Hold the detail until that release is out and give it a wide margin: the organisations that run Gerrit are the ones whose source integrity depends on it, and each of them has to upgrade a self-hosted service before the fix means anything. Because Google treats a private disclosure to a third party as grounds for disqualification, file with Google directly. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability