- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 6 excluded.
Web 1
- https://kde.org/plasma-desktop
Products and areas 13
- Input handling through KWin: keyboard grabs, global shortcut dispatch, pointer and touch routing, and the special-key path that reaches the shell before applications
- KIO in full: URL parsing, protocol dispatch and every KIO worker, including the file, http, sftp, smb, fish, tar, archive and trash handlers
- KRunner and the search and launcher path, where typed text becomes a command
- KWin as an X11 window manager, including window property handling, selections and the client boundary
- KWin as a Wayland compositor: protocol object handling, surface and buffer lifetimes, the protocol extensions it implements and the effect and scripting system
- Notifications, clipboard handling through Klipper, and drag-and-drop as the desktop arbitrates them between clients
- plasma-workspace's shell, panel, widget and applet machinery, including how a widget from the store is installed and what privileges it receives
- Screen capture, screencast and remote-desktop interfaces and the portal-facing surface behind them
- Session management, autostart handling and the D-Bus interfaces these components expose
- The KDE Security Policy publishes a contact and a process rather than a component list, so the boundary is KDE's own code. Everything below sits inside it and nothing narrower is carved out
- The KIO worker execution model itself, covering how a worker is launched, what it inherits and what a malicious URL can steer it into
- The lock screen in plasma-workspace end to end: the greeter, the unlock authentication path, what remains visible or reachable while locked and every transition into or out of the locked state
- The system settings modules and the KAuth helper mechanism, where an unprivileged action is handed to a privileged helper
Out of scope (6)
- Attacks requiring the attacker to already run code as the logged-in user, unless the finding crosses out of that user's boundary
- Configuration choices an administrator or user made deliberately
- Distribution and vendor patches, including SteamOS's own changes, rather than upstream KDE
- KDE applications outside the Plasma core trees, unless the defect is in KWin, plasma-workspace or KIO
- Qt itself, which is a separate project with its own security process and its own entry
- Third-party Plasma widgets, KWin scripts and global themes from the store, which are not KDE code. A widget that grants itself privilege is that widget's defect
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report privately to the address on the policy page , the channel named in the published KDE Security Policy, and encrypt to one of the team PGP keys listed on kde.org/info/security
-
Do not open a public issue on bugs.kde.org or on invent.kde.org for a security defect
-
KDE's primary forge is invent.kde.org. The GitHub mirrors have private vulnerability reporting disabled, so the advisory button there is not a route into this process
-
Name the repository. KWin, plasma-workspace and the KIO framework are separate trees under one desktop and the fix lands in different release cycles
-
State the session type. KWin's Wayland and X11 paths differ substantially and a finding in one often does not exist in the other
-
Say whether the defect is in Plasma's own code or in Qt beneath it, since Qt has its own security process and its own release train
-
The security page states outright that KDE has no bug bounty program. There is nothing to negotiate and no reward terms to accept
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview KDE Plasma is the default desktop on openSUSE, Kubuntu and Fedora KDE, and it ships on every Steam Deck, which puts KWin and KIO on millions of consumer devices nobody files under Linux desktop. KIO is the piece to look at first: it resolves URLs and protocol handlers for the entire desktop, and that layer has a long history of turning a link someone clicked into code running as them. KDE's own security page states plainly that the project has no bug bounty program. Reports go to a named team over PGP and earn nothing, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The KDE Security Policy publishes a contact and a process rather than a component list, so the boundary is KDE's own code. Everything below sits inside it and nothing narrower is carved out KIO in full: URL parsing, protocol dispatch and every KIO worker, including the file, http, sftp, smb, fish, tar, archive and trash handlers The KIO worker execution model itself, covering how a worker is launched, what it inherits and what a malicious URL can steer it into KWin as a Wayland compositor: protocol object handling, surface and buffer lifetimes, the protocol extensions it implements and the effect and scripting system KWin as an X11 window manager, including window property handling, selections and the client boundary Input handling through KWin: keyboard grabs, global shortcut dispatch, pointer and touch routing, and the special-key path that reaches the shell before applications The lock screen in plasma-workspace end to end: the greeter, the unlock authentication path, what remains visible or reachable while locked and every transition into or out of the locked state plasma-workspace's shell, panel, widget and applet machinery, including how a widget from the store is installed and what privileges it receives KRunner and the search and launcher path, where typed text becomes a command The system settings modules and the KAuth helper mechanism, where an unprivileged action is handed to a privileged helper Notifications, clipboard handling through Klipper, and drag-and-drop as the desktop arbitrates them between clients Screen capture, screencast and remote-desktop interfaces and the portal-facing surface behind them Session management, autostart handling and the D-Bus interfaces these components expose Out of scope Qt itself, which is a separate project with its own security process and its own entry KDE applications outside the Plasma core trees, unless the defect is in KWin, plasma-workspace or KIO Third-party Plasma widgets, KWin scripts and global themes from the store, which are not KDE code. A widget that grants itself privilege is that widget's defect Distribution and vendor patches, including SteamOS's own changes, rather than upstream KDE Configuration choices an administrator or user made deliberately Attacks requiring the attacker to already run code as the logged-in user, unless the finding crosses out of that user's boundary Most-valued findings KIO defects where a URL becomes code execution or an unintended file operation. This is the densest and highest-value area in the target: KIO handles protocol dispatch for the whole desktop and a link in a chat message or an email reaches it KIO worker path handling that escapes the location the user asked for, particularly archive and remote-filesystem workers that expand attacker-controlled names Lock-screen bypass in any form, reaching the live session or driving input into it from a locked machine. On a Steam Deck this is the entire physical security model Anything reachable before authentication on the lock screen or the session greeter KWin protocol handling that a hostile Wayland client can drive into memory corruption or object confusion, since the compositor is the only separation between clients Input routing and keyboard grab defects that let one client capture another client's keystrokes Screen capture paths that record the display without the user granting permission KAuth helper interfaces that perform a privileged action on unvalidated arguments from an unprivileged caller, the standard route from user to root on this desktop KRunner and launcher handling that turns pasted or injected text into an executed command Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , the channel named in the published KDE Security Policy, and encrypt to one of the team PGP keys listed on kde.org/info/security Do not open a public issue on bugs.kde.org or on invent.kde.org for a security defect KDE's primary forge is invent.kde.org. The GitHub mirrors have private vulnerability reporting disabled, so the advisory button there is not a route into this process Name the repository. KWin, plasma-workspace and the KIO framework are separate trees under one desktop and the fix lands in different release cycles State the session type. KWin's Wayland and X11 paths differ substantially and a finding in one often does not exist in the other Say whether the defect is in Plasma's own code or in Qt beneath it, since Qt has its own security process and its own release train The security page states outright that KDE has no bug bounty program. There is nothing to negotiate and no reward terms to accept Disclosure Coordinated by mail with the KDE security team, whose members and PGP fingerprints are published on kde.org/info/security, under the project's written security policy. Fixes land in the Plasma and Frameworks release trains, and an advisory goes out with the patched release. Distributions carrying Plasma as a default backport quickly, and SteamOS moves on Valve's own schedule, so hold detail until the advisory and the patched releases are out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability