Proton (Mail, VPN, Pass, Drive, Bridge clients)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Maximum, exceptional cases only │ $100,000 │ $101,000 Critical │ $25,000 - $50,000 │ $26,000 - $51,000 High │ $2,500 - $25,000 │ $3,125 - $26,000 Medium │ $1,000 - $2,500 │ $1,250 - $3,125 Low (case by case) │ no reward by default │ no reward by default Submit a vulnerability CVE history 1 Last 12 months 5 Lifetime Latest advisories Loading the feed Overview Proton runs the encrypted mail, VPN, password-manager, file-storage and desktop-bridge products used by people who chose them specifically because the provider is not supposed to be able to read their data. The client applications are where that promise is actually kept: they are the code that holds the keys, decrypts the content and decides what leaves the device, and every one of them is GPL-3.0 on GitHub, while the server side stays proprietary. That asymmetry is what makes the clients the interesting target: a client bug reaches plaintext the architecture is designed to keep away from the server entirely, and an update or code-signing failure in a desktop client reaches every installation at once rather than one account. Proton pays for reports itself, by email to [email protected] with a PGP key offered for the submission, and publishes a single scale adjudicated case by case by a Proton Security and Engineering panel: $1,000 to $2,500 at Medium, $2,500 to $25,000 at High, $25,000 to $50,000 at Critical, and a stated maximum of $100,000 in exceptional cases. Low-severity findings are handled case by case with no monetary reward by default. sorona.xyz adds 1.25× on top of whatever Proton awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Proton's published qualifying-vulnerability list, organised by surface rather than by repository, naming four: web applications, desktop applications, mobile applications and servers. All four are in scope; the client surfaces are the ones with source to read, GPL-3.0 on GitHub The web applications behind the products, which is the ProtonMail/WebClients codebase: Mail, Calendar, Drive, Pass and the account and authentication front end The desktop clients and Proton Bridge, including the local IMAP and SMTP server Bridge runs for third-party mail apps and the credentials it holds in order to do that The mobile applications for Mail, VPN, Pass and Drive on iOS and Android, together with their local storage and keychain use The VPN clients across platforms: tunnel and configuration handling, kill-switch and leak behaviour, and the credential storage underneath them The cryptography the clients share: key generation, storage and exchange, message and file encryption, address and key verification, and the code that decides what is encrypted before anything leaves the device Update and code-signing paths in the desktop clients and Bridge, plus the local privilege boundary each of them sits on, both named in the qualifying list Proton's servers, which the published list names as the fourth surface even though that code is proprietary and there is nothing to read Out of scope Anything outside the four published surfaces: web applications, desktop applications, mobile applications and servers Low-severity findings, which the program states carry no monetary reward by default and are handled case by case Upstream libraries the clients depend on rather than the client code Proton itself ships, which belong to the projects that publish them Proton's semi-private incubator scope on Bug Bounty Switzerland, a separate program with its own terms rather than part of this public one Publication before Proton has confirmed the fix and agreed the timing with you Most-valued findings Remote code execution through a Proton client, the top item on the published qualifying list and realistically the only class reaching the $50,000 Critical band or the $100,000 exceptional maximum Extraction of local data, credentials or keychain material from a client, because the client is the one place where end-to-end encrypted mail, files and passwords exist in plaintext A defect in the update or code-signing path of a desktop client or Bridge, where an attacker who can substitute an update owns every installation of it rather than one user's session Local privilege escalation out of a Proton client to the rest of the machine, which converts a single application compromise into a device compromise Anything that breaks the end-to-end guarantee itself, key handling, key substitution during exchange, or a path that sends readable content to the server, since that is the property the entire product is sold on and it fails silently when it fails Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Reports go by email to [email protected] , and Proton offers a PGP key for encrypting the submission Severity is adjudicated case by case by a Proton Security and Engineering panel; the $100,000 figure is a maximum for exceptional cases, not the top of a routine ladder Low-severity findings are handled case by case and carry no monetary reward by default The published qualifying-vulnerability list is organised by surface, web applications, desktop applications, mobile applications and servers, rather than by repository, so be explicit about which surface your finding lands on Only the client applications are open source, under GPL-3.0 on GitHub; the server side is proprietary, so a server finding is not a source-code review Disclosure runs through Proton: agree a timeline with the security team and hold the detail until they confirm the fix has shipped Disclosure Coordinated through Proton. Report to [email protected] , agree a timeline with the security team, and hold the detail until Proton has fixed the issue and confirmed you are clear to publish. sorona.xyz holds your finding until that point. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability