Svelte

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Svelte compiler, Tier 1 asset) │ $10,000 │ $11,000 High │ $5,000 │ $6,000 Medium │ $1,000 │ $1,250 Low │ $500 │ $625 Critical in SvelteKit (Tier 2 asset, capped at $5,000) │ $5,000 │ $6,000 Submit a vulnerability CVE history 12 Last 12 months 14 Lifetime XSS 45 % Injection 20 % Info disclosure 15 % Denial of service 10 % Latest advisories Loading the feed Overview Svelte is a compiler rather than a runtime library, so it compiles away and the code it generates is inlined directly into every application built with it. It is downloaded several million times a week and is the third most-used component framework after React and Vue. That build-time-to-runtime propagation is what makes it a supply-chain target: an escaping bug in the compiler's SSR output path is a single defect that becomes an XSS in every server-rendered Svelte application simultaneously, and it is only fixed once every downstream project rebuilds. Vercel pays the compiler as a Tier 1 asset on its open-source program, from $500 for a low finding up to $10,000 for a critical, with SvelteKit scored one tier lower. sorona.xyz adds 1.25× on top of whatever Vercel awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 7 business days Triage 10 business days after triage Bounty In scope The sveltejs/svelte repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. SvelteKit is in scope too, at Tier 2, where a critical is capped at $5,000 The compiler front end: template parsing, the analysis pass, and the way markup, expressions and directives become an internal representation Server-side code generation and the escaping helpers the generated output calls in text, attribute, style and script contexts Client-side code generation, covering DOM updates, event wiring, actions, transitions and {@html} handling The client runtime and reactivity system, including runes, stores and the effect graph The public compiler API that build tools, adapters and downstream frameworks consume SvelteKit at Tier 2: routing, the handle and handleFetch hooks, form actions, remote functions, the CSRF and origin checks, and the request handling in the official adapters SvelteKit's server-only module isolation at Tier 2, the mechanism that keeps $lib/server and *.server.js code out of a public bundle Out of scope Prototype pollution in SSR internals reported without a full chain to concrete impact Handle-hook authorization bypass via percent-encoded pathnames where the developer chose to compare raw path strings themselves x-sveltekit-pathname header spoofing, unless you can show the framework itself trusts that header Archived repositories and end-of-life versions that are no longer maintained Examples, templates and documentation snippets rather than the compiler or framework code Third-party dependency CVEs without a demonstrated end-to-end chain through Svelte or SvelteKit The Tier 1 ceiling on anything SvelteKit-specific: that asset is capped at $5,000 for a critical, so a SvelteKit finding cannot reach the compiler's $10,000 row Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity Most-valued findings An escaping failure in compiler-generated SSR output, the highest-value class here because one compiler defect becomes an XSS across every server-rendered Svelte site at once Template-literal injection in the SSR compiler that turns entity sequences into live expressions in the emitted JavaScript A server-only module guard bypass that puts $lib/server code, credentials, or internal data into the client bundle An XSS chained onward into session or token theft rather than demonstrated as an alert box On the SvelteKit side, a BODY_SIZE_LIMIT bypass in the Node adapter or unbounded allocation in Remote Function form parsing, both worth filing at the Tier 2 rate Any of the above shown against the compiler's default output rather than a configuration the reporter had to weaken Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Include a zip file with working proof-of-concept code, without one the report is not bounty-eligible Quote a SvelteKit finding at the Tier 2 rate, not the Tier 1 rate: the compiler is the $10,000 asset and SvelteKit is capped at $5,000 Prototype pollution and similar internals bugs need a complete chain to concrete impact before they are scored The defect has to be the framework's own, not an application author's decision to hand raw path strings or unescaped input to Svelte Vercel's confidentiality obligations run for two years and survive the end of the program Program stats 100 Reports resolved $241k Bounties paid 89% Response efficiency Disclosure Coordinated through Vercel. The program treats report contents as confidential and asks for written consent before anything is shared, so publication timing is Vercel's call rather than a fixed clock. sorona.xyz holds your finding until Vercel has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability