- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 8
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://brew.sh
Products and areas 12
- brew shellenv, shell completions and everything Homebrew writes into a user's shell profile
- brew update and the autoupdate path, the most frequently exercised code in the tool and the one every later install depends on
- Cask installation, where packages and vendor installers run with elevated privileges
- Checksum verification on source tarballs and on bottles, plus the bottle fetch from GitHub Packages
- Download strategies, covering curl fetches, Git and other VCS clones, and how a URL supplied by a formula is handled
- Formula and cask evaluation, which is Ruby from a tap executed on the user's machine as part of an install
- Homebrew publishes no scope statement beyond the advisory form itself. The channel takes vulnerabilities in Homebrew, and nothing narrower than that has been written down anywhere
- The brew client in full: the Ruby codebase, the whole command set and the DSL that formulae and casks are written in
- The CI and formula-review automation across the Homebrew organisation, including the bots and workflows that act on pull requests. Historically this is where the most serious findings have landed
- The JSON API on formulae.brew.sh that current clients read instead of cloning taps
- The prefix permission model under /opt/homebrew and /usr/local, including anything letting a local user influence what a later install writes or executes
- The tap mechanism: adding a tap, updating one over Git, and the trust boundary between a third-party tap and core
Out of scope (6)
- Defects in the upstream software Homebrew packages; a bug in the tool a formula installs belongs to that project
- Formula build options and compiler hardening flags, which are packaging choices rather than defects in brew
- GitHub as a platform, including GitHub Packages and Actions as services rather than Homebrew's configuration of them
- macOS itself and Apple's own tooling
- Malicious formulae or casks in a third-party tap the user chose to add, unless brew itself should have contained the damage
- Reports sent to the shut-down HackerOne program, which is paused and unmonitored
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
File a GitHub security advisory at github.com/Homebrew/brew/security/advisories/new , the channel Homebrew's own shutdown notice points at, with private vulnerability reporting confirmed enabled
-
Do not use HackerOne. That program is shut down and paused for submissions, so anything sent there goes nowhere
-
Say which prefix you tested under, /opt/homebrew on Apple silicon, /usr/local on Intel or the Linuxbrew path, since the permission model differs across them
-
Homebrew is several repositories. Be explicit about whether the defect is in brew itself, in a tap's formula or cask, or in the automation that reviews and builds them
-
A malicious formula in a third-party tap is a decision the user made when they added the tap. Show why brew should have contained it
Not accepted
-
Malicious formulae or casks in a third-party tap the user chose to add, unless brew itself should have contained the damage
-
Defects in the upstream software Homebrew packages; a bug in the tool a formula installs belongs to that project
-
macOS itself and Apple's own tooling
-
Formula build options and compiler hardening flags, which are packaging choices rather than defects in brew
-
Reports sent to the shut-down HackerOne program, which is paused and unmonitored
-
GitHub as a platform, including GitHub Packages and Actions as services rather than Homebrew's configuration of them
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 8 CVEs, 8 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 8 Last 12 months 8 Lifetime Code execution 45 % Integrity bypass 25 % Privilege escalation 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Homebrew is how software arrives on a macOS developer machine, at home and across enterprise fleets, and formula code runs with the user's privileges while casks routinely ask for more. The findings that have hurt most here landed in the formula review automation rather than in the client: a crafted pull request reaching maintainer infrastructure and executing there, which is a foothold on the channel every downstream machine already trusts. Homebrew ran a HackerOne program and shut it down, pointing researchers at a GitHub advisory form with no money attached, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Homebrew publishes no scope statement beyond the advisory form itself. The channel takes vulnerabilities in Homebrew, and nothing narrower than that has been written down anywhere The brew client in full: the Ruby codebase, the whole command set and the DSL that formulae and casks are written in Formula and cask evaluation, which is Ruby from a tap executed on the user's machine as part of an install Download strategies, covering curl fetches, Git and other VCS clones, and how a URL supplied by a formula is handled Checksum verification on source tarballs and on bottles, plus the bottle fetch from GitHub Packages The tap mechanism: adding a tap, updating one over Git, and the trust boundary between a third-party tap and core brew update and the autoupdate path, the most frequently exercised code in the tool and the one every later install depends on The JSON API on formulae.brew.sh that current clients read instead of cloning taps The prefix permission model under /opt/homebrew and /usr/local , including anything letting a local user influence what a later install writes or executes Cask installation, where packages and vendor installers run with elevated privileges The CI and formula-review automation across the Homebrew organisation, including the bots and workflows that act on pull requests. Historically this is where the most serious findings have landed brew shellenv , shell completions and everything Homebrew writes into a user's shell profile Out of scope Malicious formulae or casks in a third-party tap the user chose to add, unless brew itself should have contained the damage Defects in the upstream software Homebrew packages; a bug in the tool a formula installs belongs to that project macOS itself and Apple's own tooling Formula build options and compiler hardening flags, which are packaging choices rather than defects in brew Reports sent to the shut-down HackerOne program, which is paused and unmonitored GitHub as a platform, including GitHub Packages and Actions as services rather than Homebrew's configuration of them Most-valued findings Anything in the formula review and CI automation that executes attacker-supplied content on maintainer infrastructure. A pull request that reaches a runner holding write access to core taps compromises the distribution channel itself, and the research points at this path first Checksum verification gaps on bottles or source downloads, since that check is the only thing between a hijacked mirror and every machine that installs Code execution in brew driven by formula, cask or API content rather than by the program the user explicitly asked to install Anything that turns an unprivileged local user into a writer of the Homebrew prefix, or that abuses a cask's elevated install step to escalate Defects in brew update 's Git handling or in the JSON API path, where one poisoned response changes what every subsequent install trusts Token exposure from the GitHub credentials Homebrew uses for API access and bottle downloads, which on a developer machine often carry more than read access Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. File a GitHub security advisory at github.com/Homebrew/brew/security/advisories/new , the channel Homebrew's own shutdown notice points at, with private vulnerability reporting confirmed enabled Do not use HackerOne. That program is shut down and paused for submissions, so anything sent there goes nowhere Say which prefix you tested under, /opt/homebrew on Apple silicon, /usr/local on Intel or the Linuxbrew path, since the permission model differs across them Homebrew is several repositories. Be explicit about whether the defect is in brew itself, in a tap's formula or cask, or in the automation that reviews and builds them A malicious formula in a third-party tap is a decision the user made when they added the tap. Show why brew should have contained it There is no bounty here any more and no reward terms to accept Disclosure Coordinated through GitHub private vulnerability reporting on Homebrew/brew and published as a GitHub Security Advisory. The old HackerOne process is gone and the shutdown notice sends everything into GitHub, so the entire lifecycle now lives there. No response target is published, so agree the embargo in the advisory thread. Note that brew update reaches most machines within a day of a release, which makes the window between patch and mass adoption unusually short. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability