- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 16
- Public CVEs
- 29
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
16 assets you may test, 6 excluded.
Web 1
- https://github.com/OpenMage/magento-lts
Products and areas 15
- Cache handling and the full-page cache layer, where a poisoned entry serves to everyone
- Import, export and the dataflow tooling, which parses merchant-supplied files
- Session storage, the customer session and the admin session, plus the form key mechanism that stands in for CSRF protection
- The admin panel, its login, its session handling and the ACL that decides which admin role can reach which controller
- The block and template rendering layer, including anywhere a merchant-editable template or CMS block is evaluated
- The CMS pages, blocks and widget system, which store markup an administrator edits and every visitor renders
- The core request dispatch and routing layer, plus the layout XML engine that turns configuration into instantiated blocks and method calls
- The cron and indexer jobs, which execute with no user session and process stored data
- The HackerOne programme declares one in-scope asset, the github.com/OpenMage/magento-lts source tree, with submissions open and no bounty attached. The repository policy takes advisories on the same code, so everything in the fork is in scope and nothing narrower is carved out
- The installer, the setup scripts and the extension installation mechanism
- The media and upload paths, including anything that writes to a web-served directory
- The ORM and collection layer, covering the query builder and every filter, sort and search parameter fed into it
- The payment method modules and every callback, notification or return route a gateway uses to tell the store an order was paid
- The SOAP and REST APIs that Magento 1 exposes for integrations, and the API user and role model behind them
- The storefront in full: catalogue, search, cart, one-page checkout and the customer account area
Out of scope (6)
- Findings that only reproduce on an unmaintained stock Magento CE build with none of the fork's fixes applied
- Hosting and server configuration, including a deployment that serves the var or media directory as executable
- Magento 2 and Adobe Commerce, which are a different codebase covered by Adobe's own paid programme
- Merchant configuration and store-level settings chosen deliberately
- Third-party Magento 1 extensions and themes maintained outside the OpenMage tree
- Upstream PHP library issues, unless OpenMage's own use of the library is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Two documented channels: a draft GitHub security advisory on OpenMage/magento-lts, or the HackerOne-hosted programme at hackerone.com/openmage
-
Do not file a Magento 1 finding with Adobe.
-
Say which OpenMage release you tested and whether the defect also exists in stock Magento CE 1.9.
-
Third-party Magento 1 extensions are a separate matter. State clearly whether the reproduction needs one, because the maintainers cannot fix another author's module
-
Hold the detail well past the advisory.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 29 CVEs, 9 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 9 Last 12 months 29 Lifetime Access control 35 % Injection 25 % RCE/deserialization 22 % XSS/CSRF 18 % Latest advisories Loading the feed Overview OpenMage LTS is the maintained continuation of Magento Community Edition 1.9, and it is what the long tail of Magento 1 storefronts actually runs. Adobe declared that codebase end of life in 2020 and carved Magento 1 Community and Enterprise editions out of its bug bounty by name, while the stores kept taking card payments on it. That carve-out is the whole story here: a well-funded vendor programme sits next door and deliberately does not cover this code. OpenMage runs its own HackerOne-hosted programme with bounties switched off, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The HackerOne programme declares one in-scope asset, the github.com/OpenMage/magento-lts source tree, with submissions open and no bounty attached. The repository policy takes advisories on the same code, so everything in the fork is in scope and nothing narrower is carved out The storefront in full: catalogue, search, cart, one-page checkout and the customer account area The payment method modules and every callback, notification or return route a gateway uses to tell the store an order was paid The admin panel, its login, its session handling and the ACL that decides which admin role can reach which controller The core request dispatch and routing layer, plus the layout XML engine that turns configuration into instantiated blocks and method calls The block and template rendering layer, including anywhere a merchant-editable template or CMS block is evaluated The ORM and collection layer, covering the query builder and every filter, sort and search parameter fed into it The SOAP and REST APIs that Magento 1 exposes for integrations, and the API user and role model behind them The CMS pages, blocks and widget system, which store markup an administrator edits and every visitor renders Import, export and the dataflow tooling, which parses merchant-supplied files The media and upload paths, including anything that writes to a web-served directory Session storage, the customer session and the admin session, plus the form key mechanism that stands in for CSRF protection The cron and indexer jobs, which execute with no user session and process stored data The installer, the setup scripts and the extension installation mechanism Cache handling and the full-page cache layer, where a poisoned entry serves to everyone Out of scope Magento 2 and Adobe Commerce, which are a different codebase covered by Adobe's own paid programme Third-party Magento 1 extensions and themes maintained outside the OpenMage tree Merchant configuration and store-level settings chosen deliberately Upstream PHP library issues, unless OpenMage's own use of the library is what makes the defect reachable Hosting and server configuration, including a deployment that serves the var or media directory as executable Findings that only reproduce on an unmaintained stock Magento CE build with none of the fork's fixes applied Most-valued findings Unauthenticated code execution reachable through the dispatch, layout XML or object instantiation path. That class is what put Magento 1 stores on the map for attackers, and on this population it is still live Anything that plants persistent content in a template, layout XML entry, CMS block or media file, since payment-page skimming is the actual business model of attacks against these stores and persistence is the whole game Admin ACL bypass and admin session defects, because the admin panel reaches the payment configuration and the template editor in the same session Checkout and order total manipulation, where a request sequence produces a paid order for less than the goods are worth Payment callback and notification forgery that marks an order paid without a genuine gateway response SQL injection through collection filters, search or API parameters, the historic weak point of the Magento 1 ORM Deserialization of attacker-controlled data anywhere in the stack, a class this codebase's age makes especially likely Unauthenticated customer data disclosure through the SOAP or REST API, or through a customer account endpoint that skips its ownership check File upload handling that lands an executable file in a web-served directory Cache poisoning in the full-page cache, where one poisoned entry is served to every visitor of a card-taking page Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Two documented channels: a draft GitHub security advisory on OpenMage/magento-lts, or the HackerOne-hosted programme at hackerone.com/openmage The HackerOne programme is open for submissions and pays nothing. Its single in-scope asset is the repository source, flagged bounty-ineligible in the platform's own data Do not file a Magento 1 finding with Adobe. Adobe's programme excludes Magento 1 Community and Enterprise editions by name, so the report will be closed as out of scope Say which OpenMage release you tested and whether the defect also exists in stock Magento CE 1.9. The fork has diverged, and a finding that reaches both is a much larger finding Third-party Magento 1 extensions are a separate matter. State clearly whether the reproduction needs one, because the maintainers cannot fix another author's module There is no reward tier and no payment to negotiate on either channel Disclosure Coordinated privately through a GitHub draft advisory or the HackerOne programme, then published as a GitHub Security Advisory alongside a release. A small community team maintains this, and the population it protects is unusually slow to upgrade, since these are live storefronts on a platform their vendor abandoned. Hold the detail well past the advisory. A public Magento 1 exploit finds unpatched card-taking stores for years, and the researcher who published it owns some of that. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability