Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Netflix bug bounty programs

netflix.github.io Updated Part of Netflix

Netflix runs two public programs: a Sorona bug bounty paying up to $2,500 and a Sorona bug bounty paying up to $2,500.

Top reward
$2,500
Sorona
Programs
2
2 pay cash
Targets in scope
16
2 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Netflix Atlas

Sorona · Pays the most of the 2 programs: up to $2,500.
  • Netflix Atlas

    Sorona · Bug bounty

    Open

    Top reward

    $2,500
    Critical
    –
    High
    $2,500 (highest)
    Medium
    $750 (highest)
    Low
    –
    Safe harbor
    Partial
    First response
    7 days promised
  • Netflix Spectator

    Sorona · Bug bounty

    Open

    Top reward

    $2,500
    Critical
    –
    High
    $2,500
    Medium
    $750
    Low
    –
    Safe harbor
    Partial
    First response
    7 days promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

16 targets across all 2 programs, each listed once with the programs that cover it. 14 excluded.

  • https://netflix.github.io/atlas-docs

    Web

    Covered by Netflix Atlas

  • https://netflix.github.io/spectator

    Web

    Covered by Netflix Spectator

  • A live scope row named Open Source - Spectator carries github.com/Netflix/spectator at a maximum severity of critical and marks it a Secondary Target, and the policy's Open Source Targets Overview table names the same repository URL at the same tier

    Products and areas

    Covered by Netflix Spectator

  • Chart and image rendering in atlas-chart, which turns query output into PNG and SVG

    Products and areas

    Covered by Netflix Atlas

  • Every module in the repository's build, since the scope rows name the whole repo, and Netflix runs no hosted Atlas product a researcher could point at instead

    Products and areas

    Covered by Netflix Atlas

  • Everything the library does inside the address space of the instrumented application, since that is where its code actually runs

    Products and areas

    Covered by Netflix Spectator

  • spectatord, the sidecar and UDP line-protocol writer, which takes metric lines from any co-located process and is the one unauthenticated surface in the project

    Products and areas

    Covered by Netflix Spectator

  • The Atlas server as shipped: the in-memory dimensional time-series store, its indexing and retention behaviour, and the query engine that reads it

    Products and areas

    Covered by Netflix Atlas

  • The Atlas Stack Language in full, meaning the expression parser, the evaluator and the operator library exposed to callers

    Products and areas

    Covered by Netflix Atlas

  • The HTTP API as implemented in the repository, including /api/v1/graph, /api/v1/tags and /api/v1/publish, together with the Akka/Pekko layer serving them

    Products and areas

    Covered by Netflix Atlas

  • The ingest path: the JSON and Graphite-compatible wire codecs that take metric data from publishing hosts

    Products and areas

    Covered by Netflix Atlas

  • The instrumentation library itself: the registry, the meter implementations covering counters, timers, gauges and distribution summaries, and the tag and dimension model every measurement passes through

    Products and areas

    Covered by Netflix Spectator

  • The publishing pipeline that ships measurements to an Atlas backend, covering the HTTP client, the payload serialiser and the batching behind them

    Products and areas

    Covered by Netflix Spectator

  • The sibling ports spectator-py, spectator-go and spectator-cpp sit in their own repositories and are not named individually, so say which one you tested and expect the JVM repository to be the safest ground

    Products and areas

    Covered by Netflix Spectator

  • The spectator-reg-* registry backends, which are where third-party code plugs into the library

    Products and areas

    Covered by Netflix Spectator

  • Two structured SOURCE_CODE scope rows carry github.com/Netflix/atlas, both bounty-eligible at a maximum severity of critical and both marked Secondary Target, so the declared asset is the repository rather than any component of it

    Products and areas

    Covered by Netflix Atlas

No target matches. Try part of a host name, such as the company name.

Out of scope 14

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Automated scanner output with no demonstrated impact, along with the rate-limiting, banner and enumeration classes on the program's excluded-submission list

    Netflix Spectator

  • Automated scanner output with no demonstrated impact, plus the rate-limiting, banner disclosure and enumeration classes on the program's excluded-submission list

    Netflix Atlas

  • Dependency-confusion package takeover, which the policy names as a known root cause that will be closed as a duplicate

    Netflix Spectator

  • Dispatch OSS, which the program names explicitly in its Out-of-Scope section

    Netflix Atlas

  • Duplicates and reports filed outside the HackerOne form: first reporter only, through the program's own channel

    Netflix Spectator

  • Duplicates: you have to be the first reporter, and the report has to arrive through the HackerOne form rather than any other channel

    Netflix Atlas

  • Every other Netflix open source project apart from Zuul and Atlas: the policy states that all other Netflix open source projects are not in scope for reward at this time

    Netflix Spectator

  • Every other Netflix open source project: the policy states that all other Netflix open source projects are not in scope for reward at this time, and the Open Source Targets Overview lists only Zuul, Atlas and Spectator

    Netflix Atlas

  • Findings below Medium severity, which the Secondary tier floor rules out entirely

    Netflix Spectator

  • Findings below Medium severity. The Secondary tier has no Low row, so they are not rewarded at all

    Netflix Atlas

  • Reward is conditional on Netflix pursuing a change based on the submission, and severity is scored on impact to Netflix rather than on impact to an outside adopter

    Netflix Spectator

  • Reward is conditional on Netflix pursuing a change based on the submission, so a valid finding it chooses not to act on pays nothing

    Netflix Atlas

  • Third-party systems not hosted by Netflix, including somebody else's service that happens to link Spectator

    Netflix Spectator

  • Third-party websites or systems hosted by anyone other than Netflix, including somebody else's Atlas deployment

    Netflix Atlas

Recent changes

Reward and scope changes across every Netflix program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under netflix.github.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.