Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Dynatrace bug bounty programs

dynatrace.com Updated

Dynatrace runs three public programs: a Sorona bug bounty paying up to $625, a Sorona bug bounty paying up to $625 and a HackerOne bug bounty paying up to $10,000 (paused).

Top reward
$625
Sorona
Programs
3
3 pay cash
Targets in scope
26
5 types, deduplicated
Last change
10 Nov 2026
2 days ago

Where to report

3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Dynatrace Operator

Sorona · Pays the most of the 3 programs: up to $625.
  • Dynatrace Operator

    Sorona · Bug bounty

    Open

    Top reward

    $625
    Critical
    –
    High
    $625
    Medium
    $313
    Low
    $125
    Safe harbor
    Partial
    First response
    3 hours promised
  • Dynatrace OpenTelemetry Collector

    Sorona · Bug bounty

    Open

    Top reward

    $625
    Critical
    –
    High
    $625
    Medium
    $313
    Low
    $125
    Safe harbor
    Partial
    First response
    3 hours promised
  • Dynatrace

    HackerOne · Bug bounty

    Paused

    Top reward

    $10k
    Critical
    $10k (highest)
    High
    $2,500 (highest)
    Medium
    $750 (highest)
    Low
    $250 (highest)
    First response
    2 hours average

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

26 targets across all 3 programs, each listed once with the programs that cover it. 20 excluded.

  • *.sprint.apps.dynatracelabs.com

    Wildcards No bounty

    Covered by HackerOne

  • *.sprint.dynatracelabs.com

    Wildcards No bounty

    Covered by HackerOne

  • account-sprint.dynatracelabs.com

    Web Critical

    Covered by HackerOne

  • https://docs.dynatrace.com/docs/ingest-from/opentelemetry/collector

    Web

    Covered by Dynatrace OpenTelemetry Collector

  • https://docs.dynatrace.com/docs/ingest-from/setup-on-k8s

    Web

    Covered by Dynatrace Operator

  • myaccount-hardening.dynatracelabs.com

    Web Critical

    Covered by HackerOne

  • sso-sprint.dynatracelabs.com

    Web Critical

    Covered by HackerOne

  • https://github.com/Dynatrace

    Source code No bounty

    Covered by HackerOne

  • Dynatrace ActiveGate

    Desktop and binaries No bounty

    Covered by HackerOne

  • Dynatrace MobileAgent

    Desktop and binaries No bounty

    Covered by HackerOne

  • Dynatrace OneAgent

    Desktop and binaries No bounty

    Covered by HackerOne

  • Configuration end to end, meaning config parsing and validation, the sample configurations the repository publishes, and any setting an operator can reach that changes how untrusted telemetry is handled

    Products and areas

    Covered by Dynatrace OpenTelemetry Collector

  • Core Assets

    Products and areas No bounty

    Covered by HackerOne

  • Dynatrace's own components, including the transformation and enrichment logic applied to telemetry before it leaves the collector

    Products and areas

    Covered by Dynatrace OpenTelemetry Collector

  • Dynatrace's source-code asset names twelve repositories individually, dynatrace-otel-collector among them, eligible for bounty and submission at up to critical severity. The whole repository sits inside that declaration, priced on the "All other Assets" row rather than Core Assets

    Products and areas

    Covered by Dynatrace OpenTelemetry Collector

  • Secret and API-token handling for the Dynatrace tenant credentials the operator keeps in cluster secrets, including how they are fetched, refreshed and passed to the components it deploys

    Products and areas

    Covered by Dynatrace Operator

  • The component manifest and build definition that decide which upstream module versions are compiled in, along with the container images and packages the repository releases

    Products and areas

    Covered by Dynatrace OpenTelemetry Collector

  • The CSI driver the operator ships to mount the OneAgent code modules into application pods, which runs privileged on every node

    Products and areas

    Covered by Dynatrace Operator

  • The distribution as it ships: the pipeline this repository assembles out of receivers, processors, exporters, extensions and connectors, and the way those components are wired together into a released collector

    Products and areas

    Covered by Dynatrace OpenTelemetry Collector

  • The exporter path into a Dynatrace tenant: API token handling, endpoint selection and TLS on the way out of the customer's network

    Products and areas

    Covered by Dynatrace OpenTelemetry Collector

  • The mutating webhook that injects the OneAgent init container into workloads cluster-wide, its admission logic, and the certificate and admission-configuration handling behind it

    Products and areas

    Covered by Dynatrace Operator

  • The operator controller and everything it reconciles: the DynaKube and EdgeConnect custom resources, their validation and defaulting, and the workloads the operator creates from them

    Products and areas

    Covered by Dynatrace Operator

  • The operator's outbound client to the Dynatrace tenant: endpoint and proxy configuration, TLS, and how it treats what comes back

    Products and areas

    Covered by Dynatrace Operator

  • The program lists github.com/Dynatrace/dynatrace-operator as its own source-code asset, eligible for bounty and submission at up to critical severity, and names it again on the twelve-repository whitelist attached to the github.com/Dynatrace asset. The whole repository is in scope, priced on the "All other Assets" row

    Products and areas

    Covered by Dynatrace Operator

  • The RBAC, deployment manifests and CRD definitions the repository ships, which decide what privileges the operator holds once it is installed

    Products and areas

    Covered by Dynatrace Operator

No target matches. Try part of a host name, such as the company name.

Out of scope 20

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.dev.dynatracelabs.com

    HackerOne

  • *.dynatrace.com

    HackerOne

  • playground.apps.dynatrace.com

    HackerOne

  • university-staging.dynatracelabs.com

    HackerOne

  • wyq34449.sprint.apps.dynatracelabs.com

    HackerOne

  • EasyTrade demo application

    HackerOne

  • easyTravel demo application

    HackerOne

  • Any Dynatrace repository not on the twelve-item whitelist, plus github.com/Dynatrace-oss-contrib and github.com/Dynatrace-innovationlab, both marked ineligible for bounty and submission at max_severity: none

    Dynatrace OpenTelemetry Collector

  • Anything that requires you to test against github.com. Dynatrace permits source-code analysis only on these assets

    Dynatrace OpenTelemetry Collector

  • Anything that requires you to test against github.com. Source-code analysis is the only permitted method on these assets

    Dynatrace Operator

  • github.com/Dynatrace-oss-contrib and github.com/Dynatrace-innovationlab, both carrying eligible_for_bounty: false and max_severity: none

    Dynatrace Operator

  • Reports from accounts below 150 HackerOne reputation, the gate Dynatrace attaches to its GitHub assets. Below it a report is closed as Informative without review

    Dynatrace Operator

  • Reports from accounts below 150 HackerOne reputation. The gate is attached to the Dynatrace GitHub assets and enforced automatically, so a valid finding filed under it is closed as Informative without review

    Dynatrace OpenTelemetry Collector

  • The corporate site *.dynatrace.com, out of scope outright, and the hosted *.sprint.dynatracelabs.com and myaccount environments, which are separate assets on the same program and need a requested testing tenant

    Dynatrace Operator

  • The easyTravel and easyTrade demo applications, which are explicitly marked not bounty-eligible

    Dynatrace Operator

  • The generic exclusion list: missing security headers, self-XSS, scanner output, TLS cipher reports, CSP issues, DKIM/SPF/DMARC findings, and CSRF without a demonstrated sensitive action

    Dynatrace Operator

  • The hosted Dynatrace environments and the corporate site, separate assets on the same program. *.dynatrace.com is marked out of scope outright, and the dynatracelabs.com testing environments need a requested tenant

    Dynatrace OpenTelemetry Collector

  • The standard exclusion list: missing security headers, CSRF without a sensitive action, self-XSS, scanner output, SSL/TLS cipher reports, DNS and open-port configuration, CSP issues and subdomain takeovers

    Dynatrace OpenTelemetry Collector

  • Third-party software and protocols not under Dynatrace's control, including dependency CVEs without a chain through the operator's own code

    Dynatrace Operator

  • Upstream open-telemetry/opentelemetry-collector code, which is Dynatrace's dependency rather than Dynatrace's code. The policy excludes issues in software or protocols outside Dynatrace's control, and the sibling scope instruction names vulnerable libraries

    Dynatrace OpenTelemetry Collector

Recent changes

Reward and scope changes across every Dynatrace program, newest first.

  • Dynatrace

    Paused HackerOne

    Paused. Not accepting reports right now.

All changes · RSS feed

Recent CVEs

Published vulnerabilities in Dynatrace products, from the NVD.

Search NVD
  • CVE-2025-65176 High

    An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a "STATUS_LOGON_FAILURE" error, the agent will retrieve every user token on the machine and repeatedly attempt to access the network share while impersonating them. The exploitation of this vulnerability can allow an unprivileged a

  • CVE-2025-65176 High

    An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a "STATUS_LOGON_FAILURE" error, the agent will retrieve every user token on the machine and repeatedly attempt to access the network share while impersonating them. The exploitation of this vulnerability can allow an unprivileged a

  • CVE-2025-61304 Critical

    OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.

  • CVE-2025-61304 Critical

    OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.

  • CVE-2019-3800 Medium

    CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

  • CVE-2019-3800 Medium

    CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

About this page

This page gathers every public program listed under dynatrace.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.