- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 2
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 5 excluded.
Web 1
- https://github.com/go-acme/lego
Products and areas 12
- Certificate and private key storage on disk, including file permissions, the account key material and the certificate bundle layout
- Every DNS provider integration shipped in the repository, along with the credential handling, environment variable parsing and API clients inside each of them
- Renewal logic, including the expiry evaluation and the behaviour on a partial or failed renewal
- The ACME protocol implementation: account registration and key rollover, order and authorization handling, nonce management, and every response the client parses from a CA
- The CLI surface: argument and environment handling, the hook execution it offers, and the file paths it writes to
- The CSR construction path and the SAN handling that decides which names a certificate is requested for
- The DNS-01 challenge path in full: record creation, propagation checking, cleanup, and the resolver behaviour that decides when a challenge is considered ready
- The HTTP-01 challenge providers, covering the webroot writer, the built-in listener and the proxy and memcached variants
- The public Go API that Traefik and other embedders consume, where a caller following the documented pattern still gets something unsafe
- There is no SECURITY.md and no declared scope. The GitHub private advisory channel is enabled and produces real advisories, and it takes security defects anywhere in the lego tree, library and CLI alike
- The TLS-ALPN-01 challenge provider and the certificate it presents during validation
- The transport layer between lego and the CA, covering TLS enforcement, redirect handling and certificate verification on outbound requests
Out of scope (5)
- A DNS provider's own API behaviour rather than lego's integration with it
- An operator's deliberate configuration choice, such as pointing the webroot provider at a directory the web server executes from
- Defects in Traefik or in another consumer rather than in lego itself
- Load or availability testing against a production ACME endpoint
- The ACME server side and CA policy, which belong with the CA operating it
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report privately at github.com/go-acme/lego/security/advisories/new; private vulnerability reporting is enabled and the project has published real advisories from it
-
There is no SECURITY.md and no written policy, so propose your own disclosure timeline in the report rather than assuming one exists
-
Say whether the finding is in the library or in the CLI. lego is consumed both ways and the trust boundaries differ, because an embedding application supplies its own configuration
-
Name the provider. lego ships more than a hundred DNS provider integrations, most of them contributed and thinly reviewed, and a finding in one does not imply a finding in the rest
-
For anything reaching Traefik, report it here first. lego is a separate project from its most prominent consumer, and the fix lands in this repository
-
Test against the ACME staging environment or a local server rather than a production CA
Not accepted
-
Defects in Traefik or in another consumer rather than in lego itself
-
The ACME server side and CA policy, which belong with the CA operating it
-
A DNS provider's own API behaviour rather than lego's integration with it
-
Load or availability testing against a production ACME endpoint
-
An operator's deliberate configuration choice, such as pointing the webroot provider at a directory the web server executes from
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 2 CVEs, 2 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months 2 Lifetime Path traversal / file write 40 % Transport security 25 % Credential exposure 20 % ACME validation bypass 15 % Latest advisories Loading the feed Overview lego is the ACME library and CLI behind Traefik's certificate automation and a large number of Go-based certificate tools. It supports over a hundred DNS providers, so a running instance typically holds live API credentials for a registrar or a cloud DNS zone alongside the account key. CVE-2026-40611 is the reference point: path traversal in the webroot HTTP-01 provider gave an arbitrary file write, on a component that by design writes attacker-influenced paths into a directory a web server is serving. There is no bounty and no security policy text, only a private reporting channel on the repository. sorona.xyz pays you directly on qualified, reproduced findings. In scope There is no SECURITY.md and no declared scope. The GitHub private advisory channel is enabled and produces real advisories, and it takes security defects anywhere in the lego tree, library and CLI alike The ACME protocol implementation: account registration and key rollover, order and authorization handling, nonce management, and every response the client parses from a CA The HTTP-01 challenge providers, covering the webroot writer, the built-in listener and the proxy and memcached variants The TLS-ALPN-01 challenge provider and the certificate it presents during validation The DNS-01 challenge path in full: record creation, propagation checking, cleanup, and the resolver behaviour that decides when a challenge is considered ready Every DNS provider integration shipped in the repository, along with the credential handling, environment variable parsing and API clients inside each of them Certificate and private key storage on disk, including file permissions, the account key material and the certificate bundle layout The CSR construction path and the SAN handling that decides which names a certificate is requested for Renewal logic, including the expiry evaluation and the behaviour on a partial or failed renewal The transport layer between lego and the CA, covering TLS enforcement, redirect handling and certificate verification on outbound requests The CLI surface: argument and environment handling, the hook execution it offers, and the file paths it writes to The public Go API that Traefik and other embedders consume, where a caller following the documented pattern still gets something unsafe Out of scope Defects in Traefik or in another consumer rather than in lego itself The ACME server side and CA policy, which belong with the CA operating it A DNS provider's own API behaviour rather than lego's integration with it Load or availability testing against a production ACME endpoint An operator's deliberate configuration choice, such as pointing the webroot provider at a directory the web server executes from Most-valued findings Path traversal and arbitrary file write out of a challenge provider. CVE-2026-40611 is exactly this in the webroot HTTP-01 provider, and it is the highest-severity class the project has produced, because the target directory is one a web server is already serving Anything that weakens or removes transport protection on the way to the CA, the class CVE-2025-54799 landed in when acme/api stopped enforcing HTTPS. A downgraded ACME conversation is a certificate an attacker can influence Credential exposure from the DNS provider integrations, which hold live registrar and cloud DNS API tokens. Leakage into logs, error messages or process arguments all count Defects in a DNS provider integration that let records be created or removed outside the zone the operator intended Anything that lets a certificate be issued for a name the caller does not control, whether through CSR construction, SAN handling or challenge selection Private key and account key handling on disk: weak permissions, predictable paths, or material written somewhere the operator did not expect Propagation and readiness checking defects in the DNS-01 path that let validation proceed against a record state the client has not actually confirmed Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately at github.com/go-acme/lego/security/advisories/new; private vulnerability reporting is enabled and the project has published real advisories from it There is no SECURITY.md and no written policy, so propose your own disclosure timeline in the report rather than assuming one exists Say whether the finding is in the library or in the CLI. lego is consumed both ways and the trust boundaries differ, because an embedding application supplies its own configuration Name the provider. lego ships more than a hundred DNS provider integrations, most of them contributed and thinly reviewed, and a finding in one does not imply a finding in the rest For anything reaching Traefik, report it here first. lego is a separate project from its most prominent consumer, and the fix lands in this repository Test against the ACME staging environment or a local server rather than a production CA Disclosure Coordinated through GitHub private vulnerability reporting and published as a GitHub Security Advisory on go-acme/lego . Two advisories over the project's life is a thin record to read a cadence from, so agree the timeline explicitly. The downstream shape is what matters: a lego fix has to be picked up by Traefik and the other Go tools that vendor it before it reaches anyone, and Go consumers pin their dependencies, so a released fix is a long way from a deployed one. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability