swiyu (Swiss e-ID and Trust Infrastructure)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (realised payout; the programme publishes no tier table) │ CHF 5,000 │ CHF 6,000 High (realised; CHF 5,000 across two valid reports in May 2026, about CHF 2,500 each) │ CHF 5,000 │ CHF 6,000 Medium (realised; CHF 500 to CHF 1,000 per valid report) │ CHF 1,000 │ CHF 1,250 Low (realised and unambiguous across three months) │ CHF 250 │ CHF 313 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Latest advisories Loading the feed Overview swiyu is the technology stack behind Switzerland's state-issued electronic identity: a public-beta trust infrastructure with Android and iOS wallet apps, generic components and registries, plus implementations of Verifiable Credentials, DIDs and the OpenID4VCI and OpenID4VP protocols. All of it is published under an MIT licence: the federal announcement says "all source code initially published under an MIT licence": across roughly forty actively maintained repositories under github.com/swiyu-admin-ch. Deployment matters differently here than for a library: this is one country's identity layer, and a credential-forgery or wallet-key defect is not a site compromise but a way to be someone else in front of every verifier that trusts the federal registry. The programme runs on Bug Bounty Switzerland and is overseen by BACS; it operated privately from July 2025 and moved to public mode in April 2026, and it is unusually well evidenced for a government programme, with quarterly results published on GitHub: the Q2 2026 report records 149 submissions, 21 valid and CHF 19,500 paid between April and June. There is no published tier table. The programme states only that the reward depends on the technical impact of the vulnerability, the business criticality of the affected system or data, and the quality of the documentation you supply, so every figure on this page is realised payout arithmetic from those federal reports rather than an advertised amount; the largest single one recorded is CHF 5,000. sorona.xyz adds 1.25× on top of whatever swiyu awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The programme names the swiyu public beta trust infrastructure with its Android and iOS apps, its generic components and its registries, plus the implementations of Verifiable Credentials, DIDs, OpenID4VCI and OpenID4VP The Android and iOS wallet apps, where credentials are held and holder key material lives The generic components: the issuer and verifier services, and the base and trust registries every verification decision reads from The Verifiable Credential implementation end to end, covering issuance, holder binding, presentation, and the revocation and status-list machinery The DID implementation and its resolution path, including the tooling that creates and updates DID documents The OpenID4VCI and OpenID4VP protocol implementations, meaning the credential issuance and credential presentation flows Roughly forty actively maintained MIT-licensed repositories under github.com/swiyu-admin-ch carry this code, and the programme promises published source and technical documentation alongside a legal safe harbour Out of scope Anything outside the swiyu public beta trust infrastructure and the components the programme names. The exact asset list sits behind the app.bugbounty.ch login, so treat anything you have not seen on it as out until you have Submissions from outside the Bug Bounty Switzerland platform, which is the only channel the programme runs on, and KYC is required before a payout is released Upstream libraries and third-party services the federal repositories depend on, which belong to their own projects rather than to this programme Low business criticality prices a finding down by the programme's own stated rule, alongside technical impact and the quality of the documentation you supply, and there is no published ladder to appeal to Most-valued findings Credential forgery: anything that makes a verifier accept a verifiable credential the federal issuer never issued. That is the whole trust assumption of a state e-ID, and it is the shape of the one Critical payout on record. DID resolution and registry defects that let an attacker substitute or control the key material a credential is checked against, which breaks every downstream verification at once rather than one credential at a time Protocol-level flaws in OpenID4VCI or OpenID4VP: issuance replay, presentation-request confusion, or a flow that binds a credential to the wrong holder Key extraction or unauthorised credential use from the Android or iOS wallet, where the private key that is supposed to make a holder unimpersonable actually lives Revocation and status-list failures, where a credential that has been revoked still verifies. That is the quiet failure mode nobody notices until it is used. Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. A Bug Bounty Switzerland platform account is required. The programme moved from private invite to public mode in April 2026: "From now on, the programme will be run in public mode. This means that all hackers can take part in the programme and be rewarded for vulnerabilities they find." There is no tier table. The reward is decided on three stated variables, the technical impact, the business criticality of the affected system or data, and the quality of the documentation you provide, so the write-up is priced as well as the bug The programme explicitly promises open source code, technical documentation and a legal safe harbour ("einen sicheren Hafen"), which is what makes this stack testable at all Results are published quarterly on GitHub, including submission counts, valid-report counts and the amount paid: your report ends up in a public federal statistic There is no submission fee Program stats 149 Submissions, Q2 2026 21 Valid reports CHF 19,500 Paid, Q2 2026 Disclosure Coordinated by Bug Bounty Switzerland on the federal programme's behalf, with aggregate results published quarterly on GitHub rather than per-report advisories. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability