Sequoia PGP

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical │ EUR 10,000 │ EUR 11,000 High │ EUR 5,000 │ EUR 6,000 Medium │ EUR 3,000 │ EUR 3,750 Low │ EUR 500 │ EUR 625 Submit a vulnerability CVE history 3 Last 12 months 6 Lifetime Latest advisories Loading the feed Overview Sequoia PGP is an OpenPGP implementation, licensed LGPL-2.0-or-later, with a bug bounty run on YesWeHack and funded by the Sovereign Tech Agency: one of the small number of programs where public money, rather than a vendor's own budget, is what pays for open-source security work. The published ladder runs EUR 10,000 for a critical, EUR 5,000 for a high, EUR 3,000 for a medium and EUR 500 for a low. The ground under that ladder is thinner than the numbers suggest and you should know exactly how thin. The Sovereign Tech Agency's February 2026 tender says six programs are active where that article lists seven, and which one lapsed cannot be determined without an account. Sign in, confirm the program is live and the grid is current, and read the scope tab before you commit time. sorona.xyz adds 1.25× on top of whatever the program awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The program is named for Sequoia PGP and prices a single severity ladder with no asset split, so the LGPL-2.0-or-later codebase is the whole of it: EUR 10,000 at critical down to EUR 500 at low The packet layer: parsing and serialisation of OpenPGP packets, messages, signatures and certificates arriving from a sender the caller does not control Signature verification and the policy layer above it, which decides which algorithms, key sizes and signature types the library still treats as acceptable Certificate handling: canonicalisation, subkey and user-ID binding signatures, expiry and revocation, and the answer the library gives a caller about which key is valid for what Encryption and decryption, session key handling, and the symmetric and public-key algorithm implementations behind them Secret key material: parsing, passphrase protection and the memory handling around it, plus the pluggable crypto backends the crate can be built against The sq command-line front end and the other tooling built on the library, which is how most people actually run this code Out of scope The project's own security page at sequoia-pgp.org/security/ returns 404, so there is no upstream-published exclusion list to fall back on either Defects in an application that uses the library rather than in Sequoia's own code, which belong with that project Defects that actually live in a third-party Rust crate the project depends on, which belong upstream with that crate Findings the program grades below Low, since the recorded ladder stops at EUR 500 and prices nothing beneath it Reports from anyone unwilling or unable to complete identity verification, since KYC is recorded as a condition of payment for this program Most-valued findings A signature-verification bypass that makes a forged or tampered message verify, which is the guarantee every caller of an OpenPGP library depends on and the clearest route to the EUR 10,000 Critical rung Certificate and key handling defects that let the wrong key be trusted, or that expose private key material to a caller or an attacker who should never have seen it Memory-safety or panic-driven defects reachable purely from attacker-supplied packets during parsing, before any authentication or trust decision has been made Decryption oracles and side channels that recover plaintext or key material from a supported operation, as opposed to a timing difference with no demonstrated recovery Resource exhaustion from a crafted message that costs unbounded memory or CPU to process, which is what turns a mail or key server into a target Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. KYC is required for this program, so the payout account has to be verified in your own name Confirm the scope and the reward table on the program's live page before you start The project's own security page at sequoia-pgp.org/security/ returns 404, so YesWeHack is the reporting channel rather than an upstream address Disclosure Coordinated through YesWeHack. Hold the detail until the program confirms a fix has shipped and you are clear to publish. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability