A bug bounty for code that runs on a provider's machine, or decides what is allowed to run there.
Submit a report ↗ — Opens Golem's program on Sherlock in a new tab.Out-of-scope bug or question? security@golem.network
A good report has
- Component: Name and version or commit
- Repro: Steps, or a working PoC
- Impact: What an attacker can do
- Severity: What you would rate it
Scope
yagnaProvider daemon
Runs on the provider's machine and enforces the provider's rules.
Repositoryya-runtime-vmVM exe-unit
The sandbox: runs a requestor's workload inside a VM.
Repositorygolem-certificateCertificate verification
Verifies the certificates a provider's rules rely on to decide what a node may do.
Repository