sorona.xyz

Skip to content What this pays sorona.xyz pays the published direct rewards below on qualified, reproduced findings against the sorona.xyz platform. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $50 / 2 weeks Claude Max Submit a vulnerability Latest advisories Loading the feed Permanent recognition Accepted sorona.xyz reports permanently list your chosen name or hacker handle on the sorona.xyz Wall of Appreciation. The submission form asks you to expressly consent, and the listing never exposes your report, email, or vulnerability details. View the Wall of Appreciation Overview sorona.xyz is the vulnerability intake, triage, disclosure, and researcher collaboration platform you are using now. We want reports that protect private vulnerability material, researcher accounts, maintainer handoffs, payouts, and the integrity of the public site. Qualified sorona.xyz findings receive the published direct rewards below. Participation includes permanent public recognition on the Wall of Appreciation for accepted reports under the name or hacker handle you expressly approve on the submission form. In scope The public sorona.xyz website, submission forms, researcher inbox, and authentication or session boundaries hosted on sorona.xyz The private triage and submission-operator surfaces, including role enforcement and report lifecycle actions Proof-of-concept storage, download, and Google Drive handoff logic implemented by sorona.xyz Notification, disclosure, and maintainer-delivery pipelines where a sorona.xyz flaw could leak or alter vulnerability data Payout and public-feed integrity where a sorona.xyz flaw could falsify records, expose identity, or cross an authorization boundary Out of scope Denial of service, load testing, rate-limit exhaustion, spam, social engineering, and physical attacks Third-party services and infrastructure, including Google, GitHub, GitLab, Railway, Slack, Discord, Resend, and their own products or accounts Self-XSS, missing best-practice headers without demonstrated impact, clickjacking on pages with no sensitive action, and scanner-only reports without a working proof Reports that depend on compromised credentials, access to another person's email or device, or actions already available to the same authorized role Disclosure of information intentionally public on sorona.xyz, including opted-in Wall of Appreciation handles Most-valued findings Unauthorized access to a private report, proof of concept, Drive handoff, researcher identity, or maintainer communication Authentication or role bypass that crosses researcher, submission-operator, or full-admin boundaries Stored or reflected injection with a realistic path to account or report compromise Arbitrary file access or write in upload, storage, or attachment delivery paths Business-logic flaws that alter report status, payout, disclosure, ownership, or public recognition without authorization Program rules Submit privately through sorona.xyz. We validate the report, coordinate remediation, and pay qualified findings on the program-specific scale shown above. Use accounts and vulnerability reports you own. Do not access another researcher's report, proof of concept, Drive folder, or personal data beyond the minimum needed to demonstrate the issue. Do not disrupt production availability, send spam, perform denial-of-service testing, or automate high-volume requests. Do not test third-party providers such as Google, GitHub, GitLab, Railway, Slack, Discord, or email infrastructure; only sorona.xyz-owned code and configuration are in scope. Submit one clear report with reproducible steps and stop after establishing impact. If sensitive data is exposed, do not retain or redistribute it. Participation in this program includes public recognition: provide the name or hacker handle you want published and expressly consent on the submission form. Recognition is created only if the report is accepted. Disclosure Report sorona.xyz vulnerabilities through this private submission flow. Keep details confidential while we validate and remediate the issue. We will coordinate any public disclosure with you. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability