Fluent Bit bug bounty programs
fluentbit.io Updated
Fluent Bit runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 9
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Fluent Bit runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Fluent Bit
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | 3 days promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
- First response
- 3 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets. 5 excluded.
-
https://fluentbit.io
Web
-
Every input plugin the project ships rather than only the ones with a CVE, tail, forward, http, syslog, tcp and opentelemetry among them
Products and areas
-
Every output plugin and its serialisation path, together with the TLS layer that carries records to the central backend and the credentials it holds
Products and areas
-
MessagePack encoding and decoding, Fluent Bit's internal record format, through which every record passes whichever plugin produced it
Products and areas
-
The C core: the event loop, the memory and chunk management layer, the scheduler and the configuration parser
Products and areas
-
The HTTP monitoring and hot-reload interfaces the daemon exposes to an operator
Products and areas
-
The parsers as a family: regex, JSON, LTSV, logfmt and the multiline engine, which is what OSS-Fuzz actually targets
Products and areas
-
The project takes reports at [email protected] and through GitHub advisory reporting, and commits to acknowledging within 72 hours. What is covered is github.com/fluent/fluent-bit in full, with nothing narrower carved out
Products and areas
-
The whole filter set, including the Kubernetes metadata filter that enriches records with cluster state
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Defects that live in a vendored third-party library rather than in Fluent Bit's own code, since coverage follows the repository and every project is a separate OSS-Fuzz entry
-
Fluentd (fluent/fluentd), which has no OSS-Fuzz integration and therefore no patch pathway at all, and whose own policy separately carves out in_debug_agent eval, record_transformer with enable_ruby, and ReDoS on Ruby 3.2 and below
-
One-line fixes for non-exploitable crashes and resource-exhaustion denial of service, which the Patch Rewards rules exclude by name and which describe most of this project's fuzzing output
-
Patches outside the one-to-twelve-month age window the rules impose
-
The Chronosphere and Calyptia commercial distributions, which are vendor products rather than this repository
Recent changes
Reward and scope changes across every Fluent Bit program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under fluentbit.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.