TypeScript

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Code execution 40 % Parsing/validation 30 % Info disclosure 20 % Denial of service 5 % Latest advisories Loading the feed Overview TypeScript is the typed superset of JavaScript together with the compiler and language service that implement it, pulled roughly 245 million times a week from npm and sitting as a build-time dependency under a very large fraction of all JavaScript projects. What makes it a security target rather than a build tool is where it runs: tsc and tsserver execute inside editors, CI pipelines and build servers, and they routinely open repository content nobody has vetted. A compiler or language-service bug driven by a hostile repository is a supply-chain primitive, and Microsoft explicitly names TypeScript in the carve-out that makes local-machine-only impact payable, so exactly that class earns money here. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program, where a high-quality Critical report in the deserialization or code-injection class tops out at $15,000, and sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of microsoft/TypeScript , which the program names on its SCOPE list, at Critical or Important severity on the most recent actively maintained branch, with local-machine-only impact payable because TypeScript is one of five projects Microsoft names in the carve-out The tsc compiler front end: scanner, parser, binder and checker, driven by source files the compiler was pointed at rather than authored by the user The tsserver language service, the protocol it speaks to editor hosts, and the plugin loading it performs on a project's behalf Module and type resolution: paths and baseUrl handling, node_modules and @types lookup, and declaration emit The JavaScript and TypeScript emit pipeline, the downlevel transforms and source-map generation tsconfig.json parsing, the extends chain and project-reference resolution, including what an extended configuration is allowed to pull in The shipped command-line surface: watch mode, incremental build state and tsc --build project graphs The published typescript npm package and the GitHub Actions workflows that build and release it Out of scope Type-system unsoundness with no security impact, which the project treats as designed behaviour rather than a defect Third-party TypeScript-adjacent packages that Microsoft does not own, including language-service plugins and community @types definitions Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing Moderate and Low severity, which pay $0 at every report quality Samples, tutorials, quickstart code and anything under samples/ Documentation-only issues Anything already publicly disclosed before the submission, and dependency-confusion reports Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Code injection out of the compiler or language service when it opens a repository the user only meant to read, landing arbitrary execution on a developer workstation or build agent: this is the class carrying the $15,000 top band, and it is payable here even with purely local impact tsconfig.json or extends chain resolution that loads and runs attacker-controlled code from outside the project root before any build step the user consented to Module resolution or paths handling that walks out of the project directory and reads or writes files the compiler should never reach A tsserver protocol flaw where a crafted project or editor request crosses the language-service boundary into the host process Emit or source-map generation that lets repository content inject attacker-controlled output into artefacts that then ship downstream Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only Critical and Important severity qualify; Moderate and Low findings pay $0 under this program Reproduce on the most recent actively maintained branch, not on an old release line Local-machine-only impact is payable here, because TypeScript is one of the five repositories Microsoft names in the local-machine carve-out Type-system unsoundness with no security consequence is not a vulnerability; the type system is unsound by design and the program will close it Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC, which keeps the submission confidential until a fix ships and then publishes its own advisory or Security Update Guide entry with researcher credit. Because the program's confidentiality terms read directly on third-party disclosure, file the report with MSRC yourself first and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability