Fluentd bug bounty programs

Fluentd programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
FL Fluentd Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• FL

  Fluentd

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.fluentd.org

  Web

• Formatter plugins and the compression and chunking behaviour on the way out

  Products and areas

• Plugin loading, the plugin directory and gem installation as Fluentd performs it

  Products and areas

• Reports go through the GitHub Security Advisory form on fluent/fluentd, and the policy declares no boundary narrower than the Fluentd codebase itself

  Products and areas

• The buffer implementation, both memory and file, including what is written to disk, where and with which permissions

  Products and areas

• The configuration parser: embedded Ruby evaluation, @include handling including remote includes over HTTP, and environment variable expansion

  Products and areas

• The filter plugins, in particular record_transformer and any filter that evaluates a Ruby expression over record content

  Products and areas

• The forward protocol itself, including its handshake, shared key authentication, username and password authentication, and TLS

  Products and areas

• The input plugins shipped in the tree, covering forward, http, tail, syslog, tcp, udp, exec, unix and monitor_agent

  Products and areas

• The output plugins and the credentials each holds for its destination, along with the retry and secondary output paths

  Products and areas

• The parser plugins that run over untrusted log text: json, regexp, ltsv, csv, tsv, apache, apache2, nginx, syslog and multiline

  Products and areas

• The RPC endpoint and the monitor_agent HTTP endpoint, and what each exposes to a caller

  Products and areas

• The supervisor and worker process model, the signal handling between them and the socket manager

  Products and areas

• The tail input's file handling, position file and log rotation logic

  Products and areas

No target matches. Try part of a host name, such as the company name.