Report security issues for a potential reward. Rewards are based on the severity of the finding and its impact on the organization. Even though a report may not be bountiful, it may still qualify for company swag. Let’s work together to help secure Sonatype’s products and services while earning some extra cash and/or swag!
Check Before You Submit
Before submitting a report, please first check Important advisories of known security vulnerabilities in Sonatype products to see if this has been previously reported. Duplicate reports for the same vulnerability will be deleted.
Check Before You Submit
Before submitting a report, please first check Important advisories of known security vulnerabilities in Sonatype products to see if this has been previously reported. Duplicate reports for the same vulnerability will be deleted.
Sonatype utilizes the HackerOne platform for the Bug Bounty Program. If you do not have an HackerOne account, please send an email to security@sonatype.com to receive an invitation.
IMPORTANT: Before requesting entry to our bounty program, please ensure that you have setup a HackerOne account with both valid country and tax information filled out - Tax Forms | HackerOne Help Center
Prior to reporting, please review the program's policy for SLAs, program rules, in and out of scope vulnerabilities/applications, and bounty eligibility.
Please follow the platform's workflow to submit the report, provide comments/feedback, upload any supporting documentation, images, and/or videos.
Your submission will be reviewed by the HackerOne Triage team within 1 - 2 business days. Once triaged, Sonatype will validate the finding and you'll receive a more detailed response and potential rewards within the platform within 14 business days. Remediation of the finding will depend on the severity and complexity. We’ll try to keep you informed about our progress throughout the process.
We ask that everyone please follow responsible disclosure practices and allow time for us to release a fix prior to public release.
Sonatype Headquarters - 8161 Maple Lawn Blvd #250, Fulton, MD 20759
Tysons Office - 8281 Greensboro Drive – Suite 630, McLean, VA 22102
Australia Office - 60 Martin Place Level 1, Sydney, NSW 2000, Australia
London Office -168 Shoreditch High Street, E1 6HU London
Subscribe for all the latest software security news and events
Copyright © 2008-present, Sonatype Inc. All rights reserved. Includes the third-party code listed here. Sonatype and Sonatype Nexus are trademarks of Sonatype, Inc. Apache Maven and Maven are trademarks of the Apache Software Foundation. M2Eclipse is a trademark of the Eclipse Foundation. All other trademarks are the property of their respective owners.
Terms of Service Privacy Policy Modern Slavery Statement Event Terms and Conditions Do Not Sell My Personal Information
