Nebula

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (the only severity this asset has accepted since 2026-05-27) │ $17,000 │ $18,000 Submit a vulnerability CVE history 2 Last 12 months 2 Lifetime Auth bypass 35 % Denial of service 25 % Memory safety 15 % Access control 15 % Latest advisories Loading the feed Overview Nebula is the overlay mesh Slack built to connect its own production fleet, and it is now the engine under Defined Networking's commercial product. Outside Slack it has become one of the two or three default choices for self-hosted overlay networking alongside Tailscale and ZeroTier, with heavy use in homelab, MSP and edge/IoT fleets, and it is embedded in several NAS and router firmware packages. Its blast radius is the flat internal network it creates: a certificate-verification or host-map bug does not leak one host, it collapses the trust boundary of an entire mesh. The low CVE count against 17,000-plus stars is consistent with a small, deliberately minimal Go codebase, and with Salesforce raising the bar on 2026-05-27 to Critical severity only, which is active management rather than neglect. Salesforce pays a Critical here at $17,000 on Slack's HackerOne program, and sorona.xyz adds 1.25× on top of that award, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope github.com/slackhq/nebula is a bounty-eligible source-code asset on Salesforce's Slack program at critical maximum severity, and the asset instruction has accepted Critical severity only since 2026-05-27 The MIT-licensed Go codebase as a whole, since the asset is the repository rather than a named list of components inside it The Noise Protocol Framework handshake implementation and its certificate authority verification path, where a peer ends up trusted for an identity it should not hold Lighthouse discovery, host-map updates and the punchy/NAT-traversal logic, where a hostile peer influences another peer's routing table The Nebula certificate format parser and the nebula-cert toolchain that issues and signs those certificates The tun/tap packet path and the evaluation of Nebula's internal firewall rules Relay handling, where traffic belonging to third parties transits a node the sender does not control Out of scope Anything requiring victim-side code changes, configuration modification, SSH server modification, or a man-in-the-middle position, all of which Salesforce lists explicitly for this asset Denial of service that requires authentication, or that only works against misconfigured firewall rules Non-Critical findings of any kind on this repository, which have paid nothing since the 2026-05-27 tightening Reports with no working proof of concept Slack's SaaS product, Quip and the wider Salesforce platform assets, which the same program covers on separate asset rows and which are a different report from a Nebula finding Most-valued findings Certificate or CA verification bypass in the Noise handshake that lets an unauthorized host join or impersonate a member of the mesh. That is the clearest Critical on this asset, and auth bypass is the largest expected class at 35% Host-map or lighthouse poisoning from a hostile peer that redirects another peer's traffic across the mesh A memory-safety failure in the certificate parser or the packet path reachable from an unauthenticated remote packet Firewall rule evaluation bypass that lets traffic reach a host the rules were written to protect Relay abuse that exposes or redirects third-party traffic transiting an untrusted node, demonstrated without any victim-side change Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. This asset has accepted Critical severity only since 2026-05-27, so anything below Critical is not eligible no matter how well written up A working proof of concept is required Findings that need victim-side code changes, configuration modification, SSH server modification, or a man-in-the-middle position are excluded by rule Denial of service that requires authentication, or that relies on misconfigured firewall rules, does not qualify Whether or not Salesforce pays, it takes assignment of all right, title and interest in the contents of the report Do not discuss the vulnerability with anyone without explicit Salesforce authorization Program stats 2,292 Reports resolved $2.8M Bounties paid 99% Response efficiency Disclosure Coordinated through Salesforce, and slower than most: disclosure via HackerOne has been paused on this program since 2025-08-15, and the policy treats telling any other person about the bug as prohibited conduct absent explicit authorization. Expect no public writeup unless Salesforce grants one, and expect sorona.xyz to hold your finding until Salesforce has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability