Bug bounty
The MainSDK bug bounty: what is in scope, what we pay, and the safe harbour for good-faith research.
Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.
Stability The promise an interface ships with.
- Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
- Beta Usable in production; may change before it becomes stable.
- Experimental May change or go away; needs an explicit opt-in in main.yaml.
We pay for vulnerabilities in MainSDK itself from public beta day. Report through the programme: Report through GitHub private vulnerability reporting. Read the security policy first: it gives the disclosure rules and the fix times.
Scope
In scope
- the packages mainsdk, "@mainsdk/cli", "@mainsdk/core" and "@mainsdk/testing"
- their release artifacts, signatures and provenance
- the release workflow
- the docs site and its build
Out of scope
- apps built with MainSDK (report to their owners)
- third-party drivers published by their authors
- social engineering, denial of service by volume and physical attacks
- findings that need a modified or already-compromised machine
Rewards
We set the reward by the CVSS 4.0 severity we confirm, and pay at the top of the range for a report with a working proof and a suggested fix.
| Severity | Reward (USD) |
|---|---|
| Critical | 2,000 to 5,000 |
| High | 750 to 2,000 |
| Medium | 250 to 750 |
| Low | 100 |
Safe harbour
If you act in good faith and follow this page and the security policy, we will not start legal action against you and will not ask a platform to remove your research. Good faith means:
- You test only your own installs and accounts, and stop as soon as you see another person's data.
- You do not degrade a service, keep data you reached by accident, or publish before the fix and the advisory.
- You report through the programme link above and give us a reasonable time to fix, within the times in the policy.
We will credit you in the advisory unless you ask us not to. This is a statement of intent by the maintainers; it cannot bind third parties such as hosting providers.
Was this page helpful?