- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 6
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://github.com/astral-sh/uv
Products and areas 11
- Astral's policy invites reports of suspected security problems by email, and uv's own SECURITY.md carves out exactly three things by name: invoking system interpreters, PEP 517 source builds and building from a requested index. Everything else in uv is fair game
- Credential handling for authenticated indexes, including keyring integration and any path that sends a token to a host it does not belong to
- Hash and integrity verification, including --require-hashes and the hashes recorded in a lockfile
- Index handling: --index-url, --extra-index-url, --find-links, index priority, and any confusion between a private and a public source
- Managed Python installation, where uv downloads and unpacks an interpreter, together with the verification on that download
- Package download and extraction for wheels and source distributions alike, which is native Rust parsing archives fetched over the network
- The global cache: its keying, its entries, and anything that lets one resolution seed what a later one trusts
- The resolver in full, covering version solving, markers, extras and the uv.lock format
- Tool installation and execution through uv tool and uvx, plus the shims they write onto the path
- uv self update and the release artefacts it fetches, since that path replaces the binary that runs every later install
- Virtual environment creation, script installation and entry-point shebang handling
Out of scope (6)
- Building from an index the user asked uv to use, likewise ruled out by name
- Defects inside CPython or inside the standalone interpreter builds uv downloads, as opposed to how uv fetches and verifies them
- Executing a PEP 517 build for a source distribution, ruled out by name; running build code is what installing an sdist means
- Invoking a system Python interpreter, which the policy states is not a vulnerability in uv
- Malicious packages published to PyPI, which is registry abuse rather than a uv defect
- Ruff and Astral's other projects, which share the same security address but are separate codebases
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Include the exact command, the lockfile or requirements input, the index configuration and the uv version.
-
Say whether the cache was warm or cold, since cache-poisoning findings depend entirely on it
-
For memory-safety findings, send the crashing input and a build that reproduces.
Not accepted
-
Invoking a system Python interpreter, which the policy states is not a vulnerability in uv
-
Executing a PEP 517 build for a source distribution, ruled out by name
-
Building from an index the user asked uv to use, likewise ruled out by name
-
Malicious packages published to PyPI, which is registry abuse rather than a uv defect
-
Defects inside CPython or inside the standalone interpreter builds uv downloads
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 6 CVEs, 6 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 6 Last 12 months 6 Lifetime Memory safety 35 % Index/URL handling 25 % Cache poisoning 25 % Path handling 15 % Latest advisories Loading the feed Overview uv is Astral's Rust rewrite of the Python packaging stack, and it is displacing pip and Poetry across new projects and CI faster than anything else in that ecosystem. It resolves, downloads, extracts and caches packages in a single binary that runs at the very front of the build. That puts the interesting defects in native code handling archives fetched off a registry, and in a global cache where one poisoned entry serves every later resolution on the same machine. Astral is a funded company whose policy states it runs no bug bounty program, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Astral's policy invites reports of suspected security problems by email, and uv's own SECURITY.md carves out exactly three things by name: invoking system interpreters, PEP 517 source builds and building from a requested index. Everything else in uv is fair game The resolver in full, covering version solving, markers, extras and the uv.lock format Index handling: --index-url , --extra-index-url , --find-links , index priority, and any confusion between a private and a public source Package download and extraction for wheels and source distributions alike, which is native Rust parsing archives fetched over the network Hash and integrity verification, including --require-hashes and the hashes recorded in a lockfile The global cache: its keying, its entries, and anything that lets one resolution seed what a later one trusts Credential handling for authenticated indexes, including keyring integration and any path that sends a token to a host it does not belong to Managed Python installation, where uv downloads and unpacks an interpreter, together with the verification on that download Tool installation and execution through uv tool and uvx , plus the shims they write onto the path Virtual environment creation, script installation and entry-point shebang handling uv self update and the release artefacts it fetches, since that path replaces the binary that runs every later install Out of scope Invoking a system Python interpreter, which the policy states is not a vulnerability in uv Executing a PEP 517 build for a source distribution, ruled out by name; running build code is what installing an sdist means Building from an index the user asked uv to use, likewise ruled out by name Malicious packages published to PyPI, which is registry abuse rather than a uv defect Defects inside CPython or inside the standalone interpreter builds uv downloads, as opposed to how uv fetches and verifies them Ruff and Astral's other projects, which share the same security address but are separate codebases Most-valued findings Memory-safety defects in the Rust code that parses archives and package metadata. This is the class a native rewrite buys, and every byte of that input arrives from a registry Cache poisoning, where one install writes an entry a later install trusts. The cache is global to the machine and shared across every project and every CI job that runs on it Index confusion, where a public index satisfies a requirement the operator meant a private index to serve Hash verification gaps, in particular anything that satisfies --require-hashes with content that does not match the pin Extraction paths that write outside the target directory, which in CI runs with whatever privileges the pipeline holds Verification failures on the managed Python download or on uv self update , both of which fetch a binary and then execute it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] , the address Astral's organisation policy names. Serious findings are published as GitHub Security Advisories on the uv repository uv's SECURITY.md rules out a broad class up front: invoking system interpreters, running PEP 517 source builds and building from an index the user asked for are all stated not to be vulnerabilities in uv. Reports in that shape get closed Astral states it does not currently run any bug bounty programs. It is a venture-funded company, so re-check that sentence before you invest weeks, but there is nothing to negotiate today Include the exact command, the lockfile or requirements input, the index configuration and the uv version. Resolution and cache behaviour carry most of the real surface Say whether the cache was warm or cold, since cache-poisoning findings depend entirely on it For memory-safety findings, send the crashing input and a build that reproduces. The interesting ones live in the archive and metadata paths where the bytes come off the network Disclosure Coordinated by email with Astral, which publishes critical findings as GitHub Security Advisories on the uv repository. No response target is published, so agree the timeline in the thread. uv releases often and the fix will ship quickly, so the practical embargo runs to the next release rather than to a fixed day count. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability