.NET

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Remote Code Execution, Critical severity, complete report with working exploit │ $40,000 │ $41,000 Elevation of Privilege, Critical severity, complete report │ $40,000 │ $41,000 Security Feature Bypass, Critical severity, complete report │ $30,000 │ $31,000 Remote Code Execution, Important severity, complete report │ $30,000 │ $31,000 Remote Denial of Service, Critical severity, complete report │ $20,000 │ $21,000 Spoofing, Tampering, Information Disclosure, or Insecure Documentation, Critical severity, complete report │ $10,000 │ $11,000 Overall program range across the severity x report-quality grid │ $1,250 - $40,000 │ $1,563 - $41,000 Submit a vulnerability CVE history 15 Last 12 months 70 Lifetime Denial of service 58 % Code execution 13 % Info disclosure 12 % Access control 12 % Latest advisories Loading the feed Overview Route your report through sorona.xyz to receive 1.25x the rewards offered, plus up to $1,000 more for especially complex or well-chained bugs. .NET is Microsoft's cross-platform, open-source developer framework, and ASP.NET Core is its web stack (spanning Blazor, Aspire, and F#); both are mature, heavily audited, and back a large share of production web and cloud workloads, so meaningful findings tend to be deep rather than surface-level. In scope Current, supported releases of Microsoft .NET, covering the cross-platform runtime, the SDK, and the Base Class Library Current, supported releases of ASP.NET Core, including the Kestrel server, middleware, routing, and model binding Blazor Server and Blazor WebAssembly, both named in the July 2025 program expansion .NET Aspire, the cloud-native orchestration stack, also added in the July 2025 expansion F# and adjacent .NET languages, with the F# compiler and runtime called out specifically The latest ASP.NET Core 2.x when it runs on the .NET Framework, plus release candidates and preview builds for upcoming .NET versions and the Preview Features listed on the program's GitHub page Project and item templates bundled with supported .NET and ASP.NET Core versions (the dotnet new templates) GitHub Actions defined in the official dotnet and aspnetcore repositories, and .NET documentation and samples on learn.microsoft.com/dotnet where insecure guidance is a rewarded category Out of scope The full/classic .NET Framework, which is explicitly out of scope Earlier web stacks on .NET Framework, namely ASP.NET Web Forms and ASP.NET MVC Out-of-support or end-of-life versions of .NET or ASP.NET Core, plus daily and pre-RTM builds Platform components not unique to .NET (for example IIS, OpenSSL, and similar dependencies), and third-party dependencies the .NET team does not maintain Publicly disclosed issues and anything already reported to Microsoft Low-impact CSRF, low-impact server-side information disclosure, and bugs needing extensive or unlikely user interaction Training material, community forums, and non-product sample or community sites (outside the in-scope docs/samples category) Most-valued findings Remote Code Execution, the highest-value class, for example deserialization flaws or code injection in the runtime or framework Elevation of Privilege, valued alongside RCE at the top of the grid Security Feature Bypass of a .NET or ASP.NET Core control such as authentication, data protection, antiforgery, or CORS enforcement Remote Denial of Service through resource exhaustion or a crash in components like Kestrel or the framework parsers Spoofing or Tampering, and meaningful Information Disclosure of sensitive data Insecure documentation or sample code that steers developers into unsafe implementations Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Report a distinct, previously unreported flaw of at least Important severity that reproduces in an in-scope product Include a clear write-up and reproduction steps; a fully functional exploit qualifies a report as complete and earns the higher award, while theoretical-only reports pay less One eligible report earns a single award at the highest qualifying tier; duplicates go to the first reporter Follow the program's rules of engagement and avoid harm to customer data, privacy, or service availability Do not use automated scanning that degrades services, and do not access or modify data that is not yours Submit to sorona.xyz; we coordinate with the program and handle the payout uplift Disclosure Findings follow Coordinated Vulnerability Disclosure: keep the issue private until a fix has shipped and public discussion is cleared. sorona.xyz coordinates timing so the report stays in step with the vendor's process. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability