OpenPGP.js

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical │ €10,000 │ €11,000 High │ €5,000 │ €6,000 Medium │ €3,000 │ €3,750 Low │ €500 │ €625 Submit a vulnerability CVE history 0 Last 12 months 6 Lifetime Latest advisories Loading the feed Overview OpenPGP.js is the JavaScript implementation of the OpenPGP standard, LGPL-3.0-or-later, and the library that browser-based and Electron mail clients reach for when they need to encrypt, decrypt, sign or verify a message: Proton Mail and Mailvelope among them. Everything it touches is untrusted by construction: keys, certificates and message packets arrive from whoever sent them, and the whole point of the library is to decide what to trust on that basis, so a verification or parsing defect here means a signature that should not have verified or a message that should not have decrypted. The bounty is one of seven the Sovereign Tech Agency funded on YesWeHack, and the funder's published grid runs €10,000 for critical, €5,000 for high, €3,000 for medium and €500 for low. Check the program is actually taking reports before you commit weeks to it. sorona.xyz adds 1.25× on top of whatever the program awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The program is named for OpenPGP.js and prices a single severity ladder with no asset split, so the LGPL-3.0-or-later library is the whole of it: EUR 10,000 at critical down to EUR 500 at low The packet layer: parsing and serialisation of OpenPGP packets, messages, signatures, keys and certificates arriving from a sender the caller does not control Signature generation and verification, covering the subpacket and notation handling behind a signature as well as the key and the payload a verified result gets attributed to Encryption and decryption end to end: session key handling, the symmetric and public-key algorithms, and both the AEAD and the legacy CFB message formats Key handling: import and export, ASCII armor and de-armor, key validation, subkey and user-ID binding, expiry and revocation, and the selection logic that decides which key applies The cryptographic implementations the library carries and the points where it delegates to WebCrypto or Node's crypto, since a browser build and a server build can diverge there The public API consuming applications call, the streaming interface for large messages, and the compression and packet-nesting handling underneath it Out of scope Defects in a downstream consumer such as a mail client or browser extension rather than in OpenPGP.js, which belong with that project The OpenPGP standard itself and the other implementations of it, which are separate projects with their own maintainers and, in some cases, their own programs Findings the program grades outside its four published tiers, since the funder's scale recognises only critical, high, medium and low Reports from anyone unwilling or unable to complete identity verification, since KYC is a condition of payment on this program Most-valued findings A signature-verification bypass that makes a forged or substituted signature verify, which is the highest-value class here because every consuming mail client renders that result as an authenticity claim to a human Decryption of a message without the private key the design requires, or key-material recovery through a padding, format-confusion or oracle-style flaw in the message-handling path Key-confusion defects where the library associates a valid signature or a decryption with the wrong key or identity, since the calling application has no independent way to catch that Memory-safety-equivalent parser failures on attacker-supplied packets, unbounded allocation, infinite loops, prototype pollution or type confusion in the JavaScript decoding path, reachable simply by sending a message Cross-implementation interoperability defects with a security consequence, meaning a message another OpenPGP implementation treats one way and this library treats another, which is how OpenPGP bugs usually surface in practice Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. KYC is required for this program, so the payout account has to be verified in your own name Confirm the scope and the reward table on the program's live page before you start The Sovereign Tech Agency's February 2026 tender says six of these programs are active while the funder's own article lists seven; which one lapsed cannot be determined without an account The project's own SECURITY.md routes reporters to [email protected] and does not mention a bounty, so the upstream security channel and the paid program are separate paths Disclosure Coordinated through YesWeHack, with the project's own security address at [email protected] as the upstream channel. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability