Netflix bug bounty programs
netflix.com Updated
Netflix runs two public programs: a HackerOne bug bounty paying up to $25,000 and a self-hosted disclosure program with no cash rewards. It also owns netflix.github.io, which runs 2 more programs.
- Top reward
- $25,000
- HackerOne
- Programs
- 4
- 3 pay cash
- Targets in scope
- 46
- 6 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs Netflix runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Netflix
HackerOne · The company-wide program. Pays up to $25,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Netflix
HackerOne · Bug bounty |
$25k (highest) | $5,000 (highest) | $2,000 (highest) | $600 (highest) | $25,000 | Full | – | 1 hour average | Open |
|
Netflix
Self-hosted · Disclosure only |
– | – | – | – | No cash | Partial | – | – | Open |
-
- Critical
- $25k (highest)
- High
- $5,000 (highest)
- Medium
- $2,000 (highest)
- Low
- $600 (highest)
- Safe harbor
- Full
- First response
- 1 hour average
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Netflix owns
1 company with 2 programs of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
46 targets across all 4 programs, each listed once with the programs that cover it. 23 excluded.
-
A live scope row named Open Source - Spectator carries github.com/Netflix/spectator at a maximum severity of critical and marks it a Secondary Target, and the policy's Open Source Targets Overview table names the same repository URL at the same tier
Products and areas
Covered by Netflix Spectator
-
Affiliates or entities such as recently acquired companies
Products and areas Critical No bounty
Covered by HackerOne
-
Chart and image rendering in atlas-chart, which turns query output into PNG and SVG
Products and areas
Covered by Netflix Atlas
-
Content authorization vulnerabilities affecting only the in-browser player
Products and areas Critical No bounty
Covered by HackerOne
-
Every module in the repository's build, since the scope rows name the whole repo, and Netflix runs no hosted Atlas product a researcher could point at instead
Products and areas
Covered by Netflix Atlas
-
Everything the library does inside the address space of the instrumented application, since that is where its code actually runs
Products and areas
Covered by Netflix Spectator
-
Low impact, individually exposed Google Docs with no common root cause (see “Publicly accessible Google Document or Drive Links” in the “Corporate Targets” section)
Products and areas Critical No bounty
Covered by HackerOne
-
spectatord, the sidecar and UDP line-protocol writer, which takes metric lines from any co-located process and is the one unauthenticated surface in the project
Products and areas
Covered by Netflix Spectator
-
The Atlas server as shipped: the in-memory dimensional time-series store, its indexing and retention behaviour, and the query engine that reads it
Products and areas
Covered by Netflix Atlas
-
The Atlas Stack Language in full, meaning the expression parser, the evaluator and the operator library exposed to callers
Products and areas
Covered by Netflix Atlas
-
The HTTP API as implemented in the repository, including /api/v1/graph, /api/v1/tags and /api/v1/publish, together with the Akka/Pekko layer serving them
Products and areas
Covered by Netflix Atlas
-
The ingest path: the JSON and Graphite-compatible wire codecs that take metric data from publishing hosts
Products and areas
Covered by Netflix Atlas
-
The instrumentation library itself: the registry, the meter implementations covering counters, timers, gauges and distribution summaries, and the tag and dimension model every measurement passes through
Products and areas
Covered by Netflix Spectator
-
The publishing pipeline that ships measurements to an Atlas backend, covering the HTTP client, the payload serialiser and the batching behind them
Products and areas
Covered by Netflix Spectator
-
The sibling ports spectator-py, spectator-go and spectator-cpp sit in their own repositories and are not named individually, so say which one you tested and expect the JVM repository to be the safest ground
Products and areas
Covered by Netflix Spectator
-
The spectator-reg-* registry backends, which are where third-party code plugs into the library
Products and areas
Covered by Netflix Spectator
-
Two structured SOURCE_CODE scope rows carry github.com/Netflix/atlas, both bounty-eligible at a maximum severity of critical and both marked Secondary Target, so the declared asset is the repository rather than any component of it
Products and areas
Covered by Netflix Atlas
No target matches. Try part of a host name, such as the company name.
Out of scope 23
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
ir.netflix.com
HackerOne
-
ir.netflix.net
HackerOne
-
netflixinvestor.com
HackerOne
-
Assets associated with ReadyPlayerMe
HackerOne
-
Automated scanner output with no demonstrated impact, along with the rate-limiting, banner and enumeration classes on the program's excluded-submission list
Netflix Spectator
-
Automated scanner output with no demonstrated impact, plus the rate-limiting, banner disclosure and enumeration classes on the program's excluded-submission list
Netflix Atlas
-
Dependency-confusion package takeover, which the policy names as a known root cause that will be closed as a duplicate
Netflix Spectator
-
Dispatch OSS, which the program names explicitly in its Out-of-Scope section
Netflix Atlas
-
Duplicates and reports filed outside the HackerOne form: first reporter only, through the program's own channel
Netflix Spectator
-
Duplicates: you have to be the first reporter, and the report has to arrive through the HackerOne form rather than any other channel
Netflix Atlas
-
Every other Netflix open source project apart from Zuul and Atlas: the policy states that all other Netflix open source projects are not in scope for reward at this time
Netflix Spectator
-
Every other Netflix open source project: the policy states that all other Netflix open source projects are not in scope for reward at this time, and the Open Source Targets Overview lists only Zuul, Atlas and Spectator
Netflix Atlas
-
Findings below Medium severity, which the Secondary tier floor rules out entirely
Netflix Spectator
-
Findings below Medium severity. The Secondary tier has no Low row, so they are not rewarded at all
Netflix Atlas
-
Open Source - Consoleme
HackerOne
-
Open Source - Dispatch
HackerOne
-
Open Source - Weep
HackerOne
-
Reward is conditional on Netflix pursuing a change based on the submission, and severity is scored on impact to Netflix rather than on impact to an outside adopter
Netflix Spectator
-
Reward is conditional on Netflix pursuing a change based on the submission, so a valid finding it chooses not to act on pays nothing
Netflix Atlas
-
Set-top-boxes, smart TVs, streaming sticks Out of Scope
HackerOne
-
Third party websites or systems hosted by non-Netflix entities Out of Scope
HackerOne
-
Third-party systems not hosted by Netflix, including somebody else's service that happens to link Spectator
Netflix Spectator
-
Third-party websites or systems hosted by anyone other than Netflix, including somebody else's Atlas deployment
Netflix Atlas
Recent changes
Reward and scope changes across every Netflix program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Netflix products, from the NVD.
-
CVE-2024-9301 High
A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a
-
CVE-2024-9301 High
A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a
-
CVE-2023-40171 Critical
Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for a
-
CVE-2023-40171 Critical
Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for a
-
CVE-2023-30797 High
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
-
CVE-2023-30797 High
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
-
CVE-2022-27177 Critical
A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
-
CVE-2022-27177 Critical
A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
About this page
This page gathers every public program listed under netflix.com and the companies Netflix owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Netflix.
Something wrong or missing? Report a correction.