ScyllaDB

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Discretionary: four risk levels are named (Critical, High, Medium, Low) with no amount against any of them │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 2 Lifetime Access control 35 % Denial of service 25 % Memory safety 20 % Info disclosure 15 % Latest advisories Loading the feed Overview ScyllaDB is the C++ rewrite of Apache Cassandra, and it is the wide-column store people reach for when Cassandra's JVM latency is unacceptable: Discord moved its entire message history onto it, and Comcast, Zillow, Starbucks, Palo Alto Networks and a long tail of Cassandra migrations run it as large multi-node clusters holding primary operational data. Its Alternator frontend additionally makes it a drop-in DynamoDB replacement, which puts it in front of workloads whose designers assumed AWS-grade tenant isolation. Only two CVEs have ever been filed against it, and only one of those ever reached NVD, which for a database at this deployment scale reads as under-reporting rather than as an absence of bugs. ScyllaDB Ltd runs the bounty itself and pays cash for a report, but publishes no severity table and no amount anywhere: the page names Critical, High, Medium and Low and puts no figure against any of them, so nothing on this page should be read as a ceiling. Note also which code is actually eligible: the named open-source components are the Operator, the Monitoring Stack, the Drivers and Alternator, while the AGPL scylladb/scylladb server repository is conspicuously absent from the list, and that list is mutable at ScyllaDB's sole discretion. sorona.xyz adds 1.25× on top of whatever ScyllaDB awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The eligible-products list is the declaration and it names seven: ScyllaDB Cloud, ScyllaDB Enterprise, ScyllaDB Alternator, ScyllaDB Monitoring Stack, ScyllaDB Manager, ScyllaDB Drivers and ScyllaDB Operator. Impact has to be shown against ScyllaDB or its clients, and the list is mutable at ScyllaDB's sole discretion ScyllaDB Operator ( scylladb/scylla-operator , Apache-2.0) in full: the Kubernetes controller, its custom resources, the RBAC it provisions and the sidecar running beside each node ScyllaDB Monitoring Stack ( scylladb/scylla-monitoring , Apache-2.0): the Prometheus and Grafana deployment, its dashboards, alert rules and the scrape configuration holding cluster endpoints and credentials The ScyllaDB drivers, meaning the Go, Java, Python, Rust and C++ client repositories, covering CQL wire-protocol handling, TLS verification and connection management ScyllaDB Alternator, the DynamoDB-compatible frontend that ships inside the open-source server, including request signing, authentication and per-table isolation ScyllaDB Manager, which schedules backup, restore and repair across a cluster ScyllaDB Enterprise and ScyllaDB Cloud, both named in the eligible list, neither of them open source Out of scope ScyllaDB web site domains and any related subdomains, which the program places out of scope explicitly Targeting assets belonging to ScyllaDB's customers Any vulnerability obtained through the compromise of a ScyllaDB customer or employee account Any denial-of-service attack against ScyllaDB products or ScyllaDB customers, which is excluded even though DoS is 25% of the recorded bug distribution Social engineering of ScyllaDB employees, contractors, vendors or service providers, plus malware distribution and spam. Conducting any of these means permanent disqualification from the program The AGPL core server repository scylladb/scylladb , which is not named in the eligible-products list; the server is only reachable through Alternator, which is named Most-valued findings Authentication or authorisation bypass in Alternator, where a request authorised for one tenant, table or key reaches another. Access control is 35% of the recorded distribution, and Alternator inherits DynamoDB-shaped isolation expectations from every workload that migrated onto it Privilege escalation through the Operator: an RBAC, service-account or custom-resource path that lets a workload inside the cluster reach cluster-admin or the database's own credentials Credential and secret exposure through the Monitoring Stack, which by design holds the endpoints and scrape credentials for every node it watches Driver-side flaws in TLS verification, certificate or hostname checking, or CQL wire-protocol handling, since a driver that trusts the wrong endpoint compromises every application that links it Memory-safety defects in the C++ server reachable from client-supplied protocol data, 20% of the distribution. Note that a crash alone is excluded as denial of service, so the finding has to reach further than a fault Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Reports are accepted through the program's Google Form only, which is the single intake channel ScyllaDB operates No reward amount is published anywhere on the program, so awards are entirely at ScyllaDB's discretion and no figure can be relied on in advance Open-source findings in the Drivers, Operator or Monitoring Stack go through the same form and also get a companion public GitHub issue that carries no exploit detail The eligible-products list is explicitly mutable at ScyllaDB's sole discretion, so confirm it on the program page before you invest time Impact has to be shown against ScyllaDB or its clients, not against a hypothetical deployment Denial of service, social engineering, account compromise and testing against customer assets all mean permanent disqualification from the program Disclosure Coordinated with ScyllaDB through its Google Form, which is a channel restriction rather than a bar on third-party involvement, so routing works here with timing discipline. There is no published SLA, no response target and no platform to derive one from, so hold the detail until ScyllaDB confirms a fix; for open-source findings, the companion GitHub issue is the public artifact and it carries no exploit detail. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability