people · May 18, 2026
Turso Retires $1,000 Bug Bounty Program After AI-Generated Submissions Flood Maintainers
Share the canonical public link.
Turso CEO Glauber Costa announced on May 12, 2026 the retirement of the company's $1,000 bug bounty program for data corruption issues. The program ran for nearly one year and paid five contributors including Alperen Keles, Mikael Francoeur, and Pavan Nambi who identified gaps in Turso's Deterministic Simulator and found over ten bugs in SQLite. Turso had implemented extensive testing including fuzzers, oracle-based differential testing, concurrency simulators, and Antithesis runs before launching the bounty to cover edge cases like databases larger than 1GB. Turso maintainers spent hours reviewing low-quality AI-generated PRs such as PR #6257 and issue #5508 after an influx of slop submissions overwhelmed the system.