Lightdash bug bounty programs

Lightdash programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
LI Lightdash Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• LI

  Lightdash

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.lightdash.com

  Web

• Authentication in full: password login, Google, Okta, Azure AD, OneLogin and generic OIDC, plus the account provisioning and identity linking that follows an assertion

  Products and areas

• Query generation and execution, covering the explore and metric layer, custom dimensions, custom metrics, filters and the SQL runner

  Products and areas

• Scheduled deliveries and alerts, which run queries unattended and send results to Slack, email or a webhook a user configured

  Products and areas

• Server-side rendering for scheduled images and PDFs, where the product loads its own pages in a headless browser

  Products and areas

• Sharing: share links, public dashboard URLs, embedded dashboards and the signed tokens behind embedding, all of which reach viewers outside the normal permission model

  Products and areas

• The dbt integration: repository access, the tokens and deploy keys Lightdash holds for GitHub, GitLab, Bitbucket and Azure DevOps, and the project compilation that reads a repository's contents

  Products and areas

• The full API surface and the session, cookie and CSRF handling in front of it, along with personal access tokens and the service account paths

  Products and areas

• The organisation, project and space model in full, covering membership, roles, invitations and every check that decides whether a user reaches a dashboard, chart, space or project

  Products and areas

• The policy asks for any vulnerability report at the project security address and commits to a remediation window rather than declaring a component boundary. The whole product is in scope, and the stale supported-versions table is not a scope statement

  Products and areas

• The self-hosted deployment path, including the environment configuration and the initial setup flow

  Products and areas

• The SQL runner specifically, which lets a permitted user write arbitrary SQL against a connected warehouse

  Products and areas

• Warehouse connection handling for every supported engine, including connection parameters, credential storage, encryption and the connection test path

  Products and areas

No target matches. Try part of a host name, such as the company name.