Turborepo

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 1 asset) │ $10,000 │ $11,000 High │ $5,000 │ $6,000 Medium │ $1,000 │ $1,250 Low │ $500 │ $625 Submit a vulnerability CVE history 2 Last 12 months 2 Lifetime Code execution 40 % Access control 25 % Info disclosure 20 % Injection 10 % Latest advisories Loading the feed Overview Turborepo is the default monorepo task runner for the JavaScript ecosystem's large repositories, with roughly 30k GitHub stars and multi-million weekly npm downloads of the turbo package. It matters far more than its download count suggests because of what it does: it is a remote build cache, so a poisoned artifact is a build-output substitution that propagates to every developer and every CI job that hits that cache. Vercel Remote Cache plus self-hosted implementations put it inside a large share of front-end CI pipelines, which makes it the closest thing in the JavaScript world to a supply-chain single point of failure under one team's control. Vercel pays it as a Tier 1 asset on its open-source program, scoring with CVSS 4.0 from $500 for a low finding up to $10,000 for a critical, and sorona.xyz adds 1.25× on top of whatever Vercel awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 7 business days Triage 10 business days after triage Bounty In scope The vercel/turborepo repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. Every asset in this program is a GitHub repository, so the target is the repo rather than a hosted cache service The turbo CLI end to end: turbo.json parsing, task-graph construction, environment-variable handling and the way each task gets invoked The cache itself, local and remote, covering how an artifact is built, uploaded, downloaded and extracted back into a workspace Artifact integrity: signing, HMAC key handling and the verification step that decides whether a downloaded artifact is trusted The remote cache client and its configuration, including the API URL, the token, turbo login and turbo link , and where those credentials land on disk The daemon, its local IPC surface and the file watching it performs across the workspace Package-graph resolution across npm, pnpm and yarn workspaces, lockfile parsing included The published turbo npm packages and the platform binary packages they pull in at install time Out of scope Cache poisoning that presupposes the attacker already holds remote-cache write access, since that assumes away the interesting half of the bug Local-only attacks where the attacker already has filesystem access to the machine running turbo Asserting that signature:false as a default is itself a vulnerability, without a full poisoning chain built on top of it Scanner output, theoretical chains, and unexploited dependency CVEs Anything that only reproduces in a superseded canary or release-candidate build Findings against Vercel's hosted Remote Cache service, which belong to Vercel's main platform program rather than this open-source one Examples, templates and documentation snippets rather than Turborepo's own code Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity Most-valued findings A complete remote cache poisoning chain that puts a crafted artifact into a victim's build without presupposing write access, the top class here and the one that reaches the $10,000 critical row Signing or HMAC enforcement bypass, because it turns cache integrity from a control into a formality across every consumer of that cache Symlink traversal during extraction that writes outside the intended directory and lands as code execution on developer machines and CI runners Cache token exfiltration driven purely by repository-controlled configuration, which converts a pull request into a credential leak Command injection in turbo where the CLI passes a user-controlled string onward to a shell SSRF from an untrusted remote cache API URL reaching internal addresses, or dependency confusion against the published turbo packages Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Include a zip file with working proof-of-concept code, without one the report is not bounty-eligible Scanner output and unvalidated AI or LLM findings are marked Not Applicable Cache poisoning that presupposes the attacker already has remote-cache write access is lower priority, as are local-only attacks Bugs that only exist in a canary or release-candidate build already superseded by a stable release are out of scope Confidentiality obligations last two years from the date of disclosure, even if the program ends or your participation ceases Program stats 100 Reports resolved $241k Bounties paid 89% Response efficiency Disclosure Coordinated through Vercel, and slower to open up than most: the policy binds report contents as confidential for two years from disclosure and requires written consent before anything is shared. sorona.xyz holds your finding until Vercel has resolved it and cleared publication. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability