Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Swift

By sorona.xyz Bug bounty on Sorona swift.org

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
13
Public CVEs
1
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

13 assets you may test, 6 excluded.

Web 1

  • https://www.swift.org

Products and areas 12

  • Codable and the decoding path, which reconstructs typed objects from bytes
  • Foundation and swift-corelibs-foundation, including the property list, JSON and XML decoders that parse untrusted data
  • SIL, the optimiser and the code generation path down to LLVM, where a miscompilation can remove a bounds check or an exclusivity check the language guarantees
  • SwiftPM: manifest evaluation, dependency resolution, checkout, binary target handling, the plugin system and the build commands a package can declare
  • swift-syntax and the macro plugin protocol, which runs a compiled plugin process during every build that uses a macro
  • The C and Objective-C interoperability layers and the bridging code between them
  • The compiler front end: the parser, the type checker and the macro expansion machinery, which runs macro plugin code during compilation
  • The concurrency runtime, actors and the isolation checking that is supposed to prevent data races
  • The swift.org security process asks for vulnerabilities in the open-source toolchain by email, with a published key for sensitive material, and offers credit in the resulting advisory. It declares no component carve-out inside the toolchain, so the swiftlang repositories as shipped are the target
  • The Swift runtime: reference counting, metadata handling, dynamic casting and the reflection machinery
  • The Swift standard library, covering String, Array, the Unsafe pointer family and the runtime functions behind them
  • The toolchain distribution itself: the installers, the signature verification on downloaded toolchains and swiftly
Out of scope (6)
  • Apple's operating systems, devices, iCloud and Apple services, which sit under the Apple Security Bounty and a separate reporting process
  • LLVM itself, as distinct from Swift's use of it
  • The Unsafe APIs behaving as documented. Those types exist to leave the checked subset and doing so is the contract
  • Third-party Swift packages, unless SwiftPM's handling of them is what makes the defect reachable
  • Vapor, Hummingbird and other server frameworks, each with its own maintainers
  • Xcode and Apple's proprietary toolchain builds where the defect does not reproduce on the open-source toolchain

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.

While testing

  • Submit through sorona.xyz.
  • Email the address on the policy page and encrypt sensitive material with the published Swift.org CVE PGP key
  • Be explicit that the finding is in the open-source toolchain.
  • Name the toolchain version and the platform.
  • For a SwiftPM finding, state whether the malicious input is a Package.swift manifest, a resolved dependency, a binary target or a build plugin
  • For a miscompilation, give the source, the emitted SIL or assembly, and the optimisation level.

Not accepted

  • The Unsafe APIs behaving as documented
  • LLVM itself, as distinct from Swift's use of it
  • Third-party Swift packages, unless SwiftPM's handling of them is what makes the defect reachable
  • Vapor, Hummingbird and other server frameworks

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2018-16386 High 7.5 5 Jul 2019

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview Swift's open-source toolchain is the compiler, the standard library, Foundation and SwiftPM. Every iOS and macOS application is built with it, and server-side Swift on Vapor, Hummingbird and swift-nio puts it on the network too, with Linux and Windows toolchain use growing. A compiler is a build-pipeline component, so a defect that changes emitted code or that executes during a build reaches every binary that pipeline produces. Reports go to [email protected] with a published PGP key, and the swift.org process offers credit in an advisory and nothing more. The Apple Security Bounty is scoped to Apple's platforms and services and does not extend to these repositories. sorona.xyz pays you directly on qualified, reproduced findings. In scope The swift.org security process asks for vulnerabilities in the open-source toolchain by email, with a published key for sensitive material, and offers credit in the resulting advisory. It declares no component carve-out inside the toolchain, so the swiftlang repositories as shipped are the target The compiler front end: the parser, the type checker and the macro expansion machinery, which runs macro plugin code during compilation SIL, the optimiser and the code generation path down to LLVM, where a miscompilation can remove a bounds check or an exclusivity check the language guarantees The Swift standard library, covering String , Array , the Unsafe pointer family and the runtime functions behind them The Swift runtime: reference counting, metadata handling, dynamic casting and the reflection machinery Foundation and swift-corelibs-foundation, including the property list, JSON and XML decoders that parse untrusted data Codable and the decoding path, which reconstructs typed objects from bytes SwiftPM: manifest evaluation, dependency resolution, checkout, binary target handling, the plugin system and the build commands a package can declare swift-syntax and the macro plugin protocol, which runs a compiled plugin process during every build that uses a macro The concurrency runtime, actors and the isolation checking that is supposed to prevent data races The C and Objective-C interoperability layers and the bridging code between them The toolchain distribution itself: the installers, the signature verification on downloaded toolchains and swiftly Out of scope Apple's operating systems, devices, iCloud and Apple services, which sit under the Apple Security Bounty and a separate reporting process Xcode and Apple's proprietary toolchain builds where the defect does not reproduce on the open-source toolchain LLVM itself, as distinct from Swift's use of it Third-party Swift packages, unless SwiftPM's handling of them is what makes the defect reachable The Unsafe APIs behaving as documented. Those types exist to leave the checked subset and doing so is the contract Vapor, Hummingbird and other server frameworks, each with its own maintainers Most-valued findings Anything that executes during a build without the developer choosing it: a Package.swift manifest, a build plugin or a macro plugin running attacker code when a dependency is resolved or compiled. A compromised build machine holds signing material SwiftPM supply-chain defects: dependency resolution confusion, checkout verification, binary target handling and the treatment of a package a manifest resolves to Miscompilation that drops a bounds check, an exclusivity check or a retain. The language sells those guarantees, and a binary shipped to millions of devices inherits the failure silently Memory-safety defects in the Swift runtime, in metadata handling and in dynamic casting, all reachable from ordinary Swift on every platform Decoder defects in Foundation and Codable , particularly the property list, JSON and XML paths, which are where server-side Swift meets hostile input Anything in the C and Objective-C interoperability bridging where a Swift-side invariant gets broken from the other language The toolchain repositories carry no published advisory record, so nothing here can be prioritised by CVE density. Prioritise by what the build pipeline touches Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] and encrypt sensitive material with the published Swift.org CVE PGP key The swiftlang/swift repository's security policy points at swift.org/support/security.html. That page is the process of record Be explicit that the finding is in the open-source toolchain. Anything that plausibly lands on an Apple operating system or an Apple service can get routed into the Apple Security Bounty process instead, a different programme with different terms and a different timeline The swift.org process offers credit in an advisory. It mentions no payment at any severity Name the toolchain version and the platform. The Linux and Windows toolchains diverge from the Apple ones and a finding may exist on only one For a SwiftPM finding, state whether the malicious input is a Package.swift manifest, a resolved dependency, a binary target or a build plugin For a miscompilation, give the source, the emitted SIL or assembly, and the optimisation level. The bug is in the difference between them Disclosure Coordinated by email with the Swift.org security process and published through the project's own advisory channel with the reporter credited. The repositories carry no GitHub advisory record, so there is no cadence to plan against and the timeline gets agreed in the thread. Expect the fix in a toolchain release rather than in a point patch, and expect the Apple-platform question to come up early if the finding touches anything shipped in an OS. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability