- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 2
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 2 days
Reports go to [email protected] with a two-business-day acknowledgement target
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 6 excluded.
Web 1
- https://www.scala-lang.org
Products and areas 10
- scala.util.matching and the regular-expression surface, plus the parser combinators and any other text-processing code the distribution ships
- Serialisation of Scala objects, including the interaction between Scala's collection and function classes and Java deserialisation
- The compiler across the supported lines: parsing, typechecking, implicit resolution, macro expansion and the bytecode the back end emits
- The compiler plugin interface and anything a plugin can do to emitted bytecode
- The compiler's handling of untrusted source, which matters directly for anything that compiles user-submitted code
- The macro system and compile-time execution, since compiling a project runs code that project supplied
- The published security process asks for vulnerabilities by email to the project's security address and sets a two-business-day acknowledgement target. It declares no narrower scope, so the compiler, the standard library and the release tooling are all in
- The release and publication path: signing, the PGP keys the project publishes and the artifacts pushed to Maven Central
- The REPL and the scripting entry points, which evaluate source straight from input
- The standard library: collections, scala.io, scala.sys.process, string handling and the implicit machinery that decides what code runs
Out of scope (6)
- Apache Spark, Kafka, Akka, Pekko, Flink and Play, all separate projects with their own security processes
- Compiling source the developer wrote and trusted, since running a build is what the compiler is for
- sbt, Mill and other build tools, which are separate projects
- Scala application code with a bug of its own, as distinct from a compiler or standard library defect
- The JVM itself and the JDK class library underneath Scala
- Third-party Scala libraries published to Maven Central by other authors
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Email the address on the policy page . The team targets acknowledgement within two business days
-
Say which Scala line the finding is against. 2.12, 2.13 and 3 are different compilers with different code and a defect may only exist on one
-
Distinguish a compiler defect from a standard library defect.
-
Spark, Kafka, Akka, Pekko and Play are separate projects. Show the bug in scala/scala or the relevant Scala 3 repository before you file it here
Not accepted
-
Scala application code with a bug of its own, as distinct from a compiler or standard library defect
-
Compiling source the developer wrote and trusted, since running a build is what the compiler is for
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2022-36944 | Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. | Critical 9.8 | 23 Sep 2022 |
| CVE-2017-15288 | The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges. | High 7.8 | 15 Nov 2017 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview Scala is a JVM language whose production footprint sits in data and financial infrastructure: Apache Spark, parts of Kafka, Akka and Pekko, Flink connectors, Play, and a large share of bank and fintech JVM backends. A compiler or standard library defect there lands inside systems that move money and process other people's data at scale. The advisory record is hard to read from outside, since the project announces through its Discourse security channel and publishes nothing as a GitHub advisory. Reports go to [email protected] with a two-business-day acknowledgement target, and nothing in the project's security material mentions a reward. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published security process asks for vulnerabilities by email to the project's security address and sets a two-business-day acknowledgement target. It declares no narrower scope, so the compiler, the standard library and the release tooling are all in The compiler across the supported lines: parsing, typechecking, implicit resolution, macro expansion and the bytecode the back end emits The macro system and compile-time execution, since compiling a project runs code that project supplied The standard library: collections, scala.io , scala.sys.process , string handling and the implicit machinery that decides what code runs Serialisation of Scala objects, including the interaction between Scala's collection and function classes and Java deserialisation The compiler's handling of untrusted source, which matters directly for anything that compiles user-submitted code scala.util.matching and the regular-expression surface, plus the parser combinators and any other text-processing code the distribution ships The REPL and the scripting entry points, which evaluate source straight from input The release and publication path: signing, the PGP keys the project publishes and the artifacts pushed to Maven Central The compiler plugin interface and anything a plugin can do to emitted bytecode Out of scope Apache Spark, Kafka, Akka, Pekko, Flink and Play, all separate projects with their own security processes The JVM itself and the JDK class library underneath Scala Third-party Scala libraries published to Maven Central by other authors sbt, Mill and other build tools, which are separate projects Scala application code with a bug of its own, as distinct from a compiler or standard library defect Compiling source the developer wrote and trusted, since running a build is what the compiler is for Most-valued findings Deserialisation and gadget chains through Scala's collection and function classes. These ship on the classpath of every Spark and Akka deployment, and Java deserialisation reaches them Compiler defects where compiling untrusted source executes code, particularly through macros and compile-time evaluation. Build servers compile whatever is on the branch Miscompilation that drops a check the source required, which on the JVM means a type or bounds guarantee silently disappearing across every artifact built with that compiler Standard library defects in text and process handling reachable from data a service received rather than from code its author wrote, scala.sys.process above all Anything in the release-signing and artifact-publication path, since a compromised Scala artifact reaches an enormous share of JVM data infrastructure at once Regular-expression and parser-combinator behaviour that turns request data into unbounded CPU inside a service The project publishes no GitHub advisory record, so treat the absence of a visible CVE history as an absence of attention rather than an absence of bugs Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] . The team targets acknowledgement within two business days If that goes unanswered, the documented escalation is the meta category on the Scala Discourse or the #admin channel on the project Discord Announcements go out through the Discourse Security Announcements channel rather than as GitHub advisories, so watch there for the fix Say which Scala line the finding is against. 2.12, 2.13 and 3 are different compilers with different code and a defect may only exist on one Distinguish a compiler defect from a standard library defect. A miscompilation and a library bug get very different treatment and different release timelines Spark, Kafka, Akka, Pekko and Play are separate projects. Show the bug in scala/scala or the relevant Scala 3 repository before you file it here Nothing in the project's security material offers a reward, and no programme exists on any platform Disclosure Coordinated by email with the Scala security team, acknowledged inside two business days, with escalation available through Discourse meta and the project Discord. Announcements are published to the Discourse Security Announcements channel alongside a patched release, and the project publishes the PGP keys it signs releases with. There is no GitHub advisory feed to read a cadence from, so agree the disclosure date in the thread. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability