Backstage bug bounty programs

Backstage programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
BA Backstage Sorona · Bug bounty	$8,000	$4,000	$700	$500	$8,000	Partial	–	5 days promised	Open

• BA

  Backstage

  Sorona · Bug bounty

  Open

  Top reward

  $8,000

  Critical

  $8,000

  High

  $4,000

  Medium

  $700

  Low

  $500

  Safe harbor

  Partial

  First response

  5 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://backstage.io

  Web

• Authentication and identity in auth-backend: the OAuth and OIDC providers it ships, the sign-in resolvers, and the Backstage tokens issued off the back of them

  Products and areas

• backstage.io, the documentation site, listed as its own Non-Core asset capped at medium severity

  Products and areas

• Configuration loading, including secret resolution and the split between backend config and what the frontend is allowed to read

  Products and areas

• Scaffolder: template parsing, parameter handling, and the actions that execute against real repositories and real infrastructure

  Products and areas

• Spotify's program names the Backstage repository itself, twice over. Core Backstage source code covers the packages on Spotify's enumerated Core list at critical severity on the Core reward row, $500 to $8,000. A second row, https://github.com/backstage/backstage, covers every component of the repo that is not on that list, paid on the Non-Core row and capped at medium. The whole open-source monorepo is bounty-eligible and only the tier differs

  Products and areas

• TechDocs, Search, the Kubernetes plugin and the other plugins shipped in-tree, all bounty-eligible as Non-Core components of the monorepo

  Products and areas

• The backend framework: service and plugin initialisation, the HTTP router, the database and cache services, and the isolation the backend system puts between plugins

  Products and areas

• The Core packages Spotify enumerates one by one: @backstage/backend-defaults, @backstage/backend-plugin-api, @backstage/catalog-client, @backstage/catalog-model, @backstage/cli, @backstage/config, app-defaults, backend-common, backend-test-utils and the rest of that list

  Products and areas

• The frontend app packages and core-app-api, plus the @backstage/cli with its dev server and build pipeline

  Products and areas

• The permission framework and its policy evaluation, which decides what an authenticated portal user may see and do

  Products and areas

• The proxy backend and the SCM integrations package, which broker GitHub, GitLab, Bitbucket and Azure credentials on behalf of the signed-in user

  Products and areas

• The software catalog: entity ingestion, processors and providers, the entity model and its validation, and the catalog API

  Products and areas

No target matches. Try part of a host name, such as the company name.