Metabase bug bounty programs

Metabase programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
ME Metabase Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• ME

  Metabase

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.metabase.com

  Web

• Alerts, subscriptions and scheduled reports, which run queries unattended and deliver results to an address a user chose

  Products and areas

• Authentication end to end: password login, API keys, SSO through SAML, JWT and Google, and the account provisioning that follows a successful assertion

  Products and areas

• Database connection handling for every shipped driver, including connection string parameters, credential storage, encryption at rest and the connection test endpoint

  Products and areas

• Public links, embedding and the signed embedding tokens, which expose questions and dashboards to unauthenticated visitors by design

  Products and areas

• Sandboxing and row-level restrictions, which are the boundary an operator relies on to let one team see a subset of another team's table

  Products and areas

• The admin surface, including the audit tools and every setting an administrator can change on a running instance

  Products and areas

• The full REST API, including the session, card, dashboard, collection, database and setup endpoints, plus CSRF and session cookie handling

  Products and areas

• The native query editor and the query processor, covering how a user's SQL is built, parameterised and sent to the underlying engine

  Products and areas

• The permission model in full: collection permissions, data permissions, native query privileges, group membership and every check that decides whether a user reaches a question, dashboard or database

  Products and areas

• The policy asks for responsible disclosure of security information by email and draws no component boundary at all. Everything Metabase ships is inside it

  Products and areas

• The setup and initialisation flow, along with any endpoint that remains reachable before an instance has been configured

  Products and areas

• Uploads, model persistence, caching and the application database, wherever query results or user content are stored and read back

  Products and areas

No target matches. Try part of a host name, such as the company name.