- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 15
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 2 days
The policy commits to acknowledging a report within two business days
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
15 assets you may test, 6 excluded.
Web 1
- https://zulip.com
Products and areas 14
- Authentication backends: password, LDAP, SAML, OIDC and social login, along with session handling and the invitation flow
- Channel and direct message access control, covering private channels, the checks applied when a user joins or is added, and guest users, who are the lowest-trust account the product issues
- File upload and attachment serving, including the access check applied when an attachment URL is requested
- Integrations and incoming webhooks, the surface that accepts data from external systems and turns it into messages
- Markdown rendering, link preview generation and any other path where the server fetches a URL a user supplied
- Message editing, deletion and the moderation controls layered over them
- Message history visibility rules, including what a newly added member can read and what happens when a channel's policy changes
- The Electron desktop client, particularly its handling of untrusted message content and its update path
- The Flutter mobile client, including deep link handling and notification processing
- The mobile push notification bouncer, which relays notifications on behalf of self-hosted servers
- The organisation settings and administration surface, including user role changes and the export and import machinery
- The policy declares its in-scope surface as the Zulip server together with the Electron desktop application and the Flutter mobile application, and takes reports on all three through the same channels. Nothing narrower is carved out
- The realm boundary on a server hosting several organisations, where a realm is one organisation's whole message history
- The REST API in full, plus API keys, bot accounts and the bot token model
Out of scope (6)
- An organisation permission or channel policy an administrator set deliberately
- Public disclosure before the coordinated release, which the policy's process rules out
- Self-hosting and deployment configuration, including a server run against the documented installation guidance
- Testing against live instances holding other organisations' private conversations
- Third-party integrations' own systems, which are separate estates rather than Zulip code
- Upstream Python, Django and JavaScript dependency issues, unless Zulip's own use of the dependency is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report privately to the address on the policy page , the channel open to anyone.
-
The declared surface covers the server plus the Electron desktop client and the Flutter mobile client. Say which one you tested
-
State which you reproduced on
-
Hold the detail until the release is out
Not accepted
-
Upstream Python, Django and JavaScript dependency issues, unless Zulip's own use of the dependency is what makes the defect reachable
-
Self-hosting and deployment configuration, including a server run against the documented installation guidance
-
An organisation permission or channel policy an administrator set deliberately
-
Public disclosure before the coordinated release
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-40300 | Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0. | Medium 6.0 | 12 May 2026 |
| CVE-2026-25742 | Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after | Medium 5.3 | 3 Apr 2026 |
| CVE-2026-26058 | Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes the server to copy any file the zulip user can read into the uploads directory during import. This issue has been patched in version 11.6. | Medium 6.1 | 3 Apr 2026 |
| CVE-2026-24050 | Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5. | Low 1.1 | 6 Feb 2026 |
| CVE-2025-52559 | Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issu | Medium 6.8 | 2 Jul 2025 |
| CVE-2025-47930 | Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique works for creating private channels without permission, though such a process requires either the API or | Medium 5.3 | 16 May 2025 |
| CVE-2025-31478 | Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email address domains or invitations being required to join, but has disabled the EmailAuthBackend that is used for email/password authentication. A bug | High 8.2 | 16 Apr 2025 |
| CVE-2025-30368 | Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete an export of a different organization. This is fixed in Zulip Server 10 | Low 2.7 | 31 Mar 2025 |
| CVE-2025-30369 | Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete custom profile fields belonging to a different organizati | Low 2.7 | 31 Mar 2025 |
| CVE-2025-27149 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectl | Medium 4.6 | 31 Mar 2025 |
| CVE-2024-56136 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an email address is in use by a user. Zulip Server 9.4 resolves the issue, as does the `main` branch of Zulip | Medium 6.9 | 16 Jan 2025 |
| CVE-2024-36612 | Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. | High 7.5 | 29 Nov 2024 |
| CVE-2024-36624 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js. | Medium 5.4 | 29 Nov 2024 |
| CVE-2024-36625 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts. | Medium 5.4 | 29 Nov 2024 |
| CVE-2024-27286 | Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequent messages as well, or move just a single message. If the user chose to just move one message, and was moving it from a public stream to a private stream, Zulip would successfully move the message, -- but active users who did not have access | Medium 6.5 | 20 Mar 2024 |
| CVE-2024-21630 | Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to | Medium 4.3 | 25 Jan 2024 |
| CVE-2023-47642 | Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stream incorrectly continued being able to use the Zulip API to access metadata for that stream. As a result, users who had been removed from a stream, but still had an account in the organization, could still view metadata for that stream (incl | Medium 4.3 | 16 Nov 2023 |
| CVE-2023-32678 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since retain the ability to edit messages/topics, move messages to other streams, and delete messages that they used to have access to, if other relevant organization permissions allow these actions. For example, | Medium 6.5 | 25 Aug 2023 |
| CVE-2023-33186 | Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can se | High 8.2 | 30 May 2023 |
| CVE-2023-28623 | Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can cre | Medium 6.5 | 19 May 2023 |
| CVE-2023-32677 | Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite a new user also allows them to set the streams that the new user is invited to -- even if the inviting | Low 3.1 | 19 May 2023 |
| CVE-2023-22735 | Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitrary `Content-Type` which would be served from the Zulip hostname with `Content-Disposition: inline` and no `Content-Security-Policy` header, allowing them to trick other users into executing arbitrary Javascript in the context of the Zulip a | Medium 4.4 | 7 Feb 2023 |
| CVE-2022-41914 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be possible for an attacker to infer the value of the token by performing a sophisticated timing analys | Low 3.7 | 16 Nov 2022 |
| CVE-2022-36048 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker | Medium 4.3 | 31 Aug 2022 |
| CVE-2022-35962 | Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch was released in version 27.190. | High 8.0 | 29 Aug 2022 |
| CVE-2016-4426 | In zulip before 1.3.12, bot API keys were accessible to other users in the same realm. | Medium 4.3 | 28 Jul 2022 |
| CVE-2016-4427 | In zulip before 1.3.12, deactivated users could access messages if SSO was enabled. | High 7.5 | 28 Jul 2022 |
| CVE-2022-31168 | Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaroun | Medium 5.4 | 22 Jul 2022 |
| CVE-2022-31134 | Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams | Medium 4.9 | 12 Jul 2022 |
| CVE-2022-31017 | Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current s | Low 2.0 | 25 Jun 2022 |
| CVE-2022-24751 | Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading | Medium 5.4 | 16 Mar 2022 |
| CVE-2022-23656 | Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topi | Medium 4.6 | 2 Mar 2022 |
| CVE-2021-3967 | Improper Access Control in GitHub repository zulip/zulip prior to 4.10. | High 8.8 | 26 Feb 2022 |
| CVE-2022-21706 | Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation created in one organization (potentially as a role with elevated permissions) can be used to join any oth | High 7.2 | 26 Feb 2022 |
| CVE-2021-43799 | Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (until first reboot, or restart of RabbitMQ) does not successfully limit the default ports which RabbitMQ opens; this includes port 25672, the RabbitMQ distribution port, which is used as a management port. RabbitMQ's defau | High 8.6 | 25 Jan 2022 |
| CVE-2021-3866 | Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6. | Medium 5.4 | 20 Jan 2022 |
| CVE-2021-43791 | Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a user to the check_prereg_key_and_redirect endpoint, before getting redirected to POST to /accounts/reg | Medium 6.5 | 2 Dec 2021 |
| CVE-2021-41115 | Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks; most simply, by config | Medium 4.3 | 7 Oct 2021 |
| CVE-2021-30477 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to. | Medium 4.3 | 15 Apr 2021 |
| CVE-2021-30478 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation. | Medium 4.3 | 15 Apr 2021 |
| CVE-2021-30479 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization. | Medium 5.3 | 15 Apr 2021 |
| CVE-2021-30487 | In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation. | Low 2.7 | 15 Apr 2021 |
| CVE-2020-10857 | Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution. | Critical 9.8 | 5 Feb 2021 |
| CVE-2020-10858 | Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler. | Medium 5.3 | 5 Feb 2021 |
| CVE-2020-14194 | Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link. | Medium 5.4 | 21 Aug 2020 |
| CVE-2020-14215 | Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations. | High 7.5 | 21 Aug 2020 |
| CVE-2020-15070 | Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value. | High 8.8 | 21 Aug 2020 |
| CVE-2020-12759 | Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook. | Medium 6.1 | 21 Aug 2020 |
| CVE-2020-10935 | Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover. | Medium 5.4 | 20 Apr 2020 |
| CVE-2020-9444 | Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality. | Medium 6.1 | 20 Apr 2020 |
| CVE-2020-9445 | Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality. | Medium 6.1 | 20 Apr 2020 |
| CVE-2019-19775 | The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users. | Medium 6.1 | 18 Dec 2019 |
| CVE-2019-18933 | In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account. | Critical 9.8 | 21 Nov 2019 |
| CVE-2019-16215 | The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages. | Medium 6.5 | 18 Sep 2019 |
| CVE-2019-16216 | Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack is only effective against browsers lacking support for Content-Security-Policy such as Internet Explor | Medium 5.4 | 18 Sep 2019 |
| CVE-2018-9986 | In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor. | Medium 6.1 | 18 Apr 2018 |
| CVE-2018-9987 | In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications. | Medium 6.1 | 18 Apr 2018 |
| CVE-2018-9990 | In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead. | Medium 6.1 | 18 Apr 2018 |
| CVE-2018-9999 | In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend. | Medium 5.4 | 18 Apr 2018 |
| CVE-2017-0910 | In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm. | High 8.8 | 27 Nov 2017 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 5 Last 12 months 32 Lifetime Access control 40 % Info disclosure 25 % XSS 20 % Auth bypass 15 % Latest advisories Loading the feed Overview Zulip is the threaded team chat that universities, government bodies and large open-source communities self-host when they will not put internal conversation into somebody else's SaaS. What an instance holds is an organisation's entire private message history plus every file its members have dropped into it. Zulip publishes the most detailed security policy in this category, issues its own CVEs and acknowledges reports within two business days, and it runs an invitation-based HackerOne programme for disclosure with no bounty attached. Nothing in the policy or on the security page mentions payment at any severity. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy declares its in-scope surface as the Zulip server together with the Electron desktop application and the Flutter mobile application, and takes reports on all three through the same channels. Nothing narrower is carved out The realm boundary on a server hosting several organisations, where a realm is one organisation's whole message history Channel and direct message access control, covering private channels, the checks applied when a user joins or is added, and guest users, who are the lowest-trust account the product issues Message history visibility rules, including what a newly added member can read and what happens when a channel's policy changes Message editing, deletion and the moderation controls layered over them The REST API in full, plus API keys, bot accounts and the bot token model Integrations and incoming webhooks, the surface that accepts data from external systems and turns it into messages File upload and attachment serving, including the access check applied when an attachment URL is requested Markdown rendering, link preview generation and any other path where the server fetches a URL a user supplied Authentication backends: password, LDAP, SAML, OIDC and social login, along with session handling and the invitation flow The mobile push notification bouncer, which relays notifications on behalf of self-hosted servers The organisation settings and administration surface, including user role changes and the export and import machinery The Electron desktop client, particularly its handling of untrusted message content and its update path The Flutter mobile client, including deep link handling and notification processing Out of scope Third-party integrations' own systems, which are separate estates rather than Zulip code Upstream Python, Django and JavaScript dependency issues, unless Zulip's own use of the dependency is what makes the defect reachable Self-hosting and deployment configuration, including a server run against the documented installation guidance An organisation permission or channel policy an administrator set deliberately Testing against live instances holding other organisations' private conversations Public disclosure before the coordinated release, which the policy's process rules out Most-valued findings Cross-realm access on a server hosting several organisations, the highest-consequence class the product has Private channel and direct message content reaching a user who was never subscribed. Guest accounts above all, since a guest is the account an organisation gives to an outsider The file upload and attachment path, where an attachment URL that skips the message's access check is the classic way private content escapes a chat server Message history visibility defects, particularly around a channel policy change or a newly added member reading what they were never meant to see Markdown and link preview processing, both because the server fetches URLs on a user's behalf, giving server-side request forgery, and because rendering attacker-controlled text in every recipient's client gives cross-site scripting API key and bot token scope, where a bot or key acts beyond the channels and permissions it holds Authentication backend defects in LDAP, SAML or the social login paths, identity binding above all The push notification bouncer, which handles traffic on behalf of many self-hosted servers at once and is a shared piece of infrastructure rather than one organisation's The Electron client rendering untrusted message content with elevated privilege, where a chat message becomes code on a member's desktop Privilege escalation from member to organisation administrator, which reaches the export machinery and with it every message the organisation has ever sent Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , the channel open to anyone. The HackerOne programme is invitation-based and cannot be joined by filing That HackerOne programme is a disclosure programme with bounties switched off. Being invited to it does not mean being paid The policy commits to acknowledging a report within two business days, and Zulip issues CVEs for its own findings, so expect an identifier rather than credit alone The declared surface covers the server plus the Electron desktop client and the Flutter mobile client. Say which one you tested Self-hosted deployments and Zulip Cloud share a server codebase but differ in configuration and in which authentication backends are wired up. State which you reproduced on The policy asks how you would like to be credited. Recognition is what is on offer; there is no payment to negotiate Disclosure Coordinated privately with the Zulip security team by email or through the invitation-based HackerOne programme, then published with a CVE the project issues itself and a patched release. The policy commits to acknowledgement within two business days and carries a researcher resources section, which is more support than almost anything else in this category offers. No fixed embargo length is published. Hold the detail until the release is out, and account for self-hosted operators at universities and government bodies who upgrade on their own slow cycle. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability