New Relic bug bounty programs
newrelic.com Updated
New Relic runs two public programs: a Sorona bug bounty paying up to $6,000 and a Bugcrowd bug bounty paying up to $6,000.
- Top reward
- $6,000
- Sorona
- Programs
- 2
- 2 pay cash
- Targets in scope
- 21
- 5 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
New Relic agents
Sorona · Pays the most of the 2 programs: up to $6,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
New Relic agents
Sorona · Bug bounty |
$6,000 (highest) | $2,500 (highest) | $500 | $250 (highest) | $6,000 | Partial | – | 30 days promised | Open |
|
New Relic Public Bug Bounty Program
Bugcrowd · Bug bounty |
$6,000 | $2,500 | $600 (highest) | $200 | $6,000 | Partial | – | 30 days promised | Open |
-
- Critical
- $6,000 (highest)
- High
- $2,500 (highest)
- Medium
- $500
- Low
- $250 (highest)
- Safe harbor
- Partial
- First response
- 30 days promised
-
- Critical
- $6,000
- High
- $2,500
- Medium
- $600 (highest)
- Low
- $200
- Safe harbor
- Partial
- First response
- 30 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
21 targets across all 2 programs, each listed once with the programs that cover it. 13 excluded.
-
Kubernetes integrations such as nri-kubernetes, which run inside the cluster they observe. These reach scope through docs.newrelic.com rather than through the Tier One list, so tie the finding to the documented integration
Products and areas
Covered by Sorona
-
The agent-to-backend transport: the brief states that traffic between the agents and New Relic backend services may be inspected, and that reports about how the agent connects and transports information are acceptable
Products and areas
Covered by Sorona
-
The APM language agents in Java, .NET, Node.js, Python, Ruby, Go and PHP, each of which is loaded into the address space of the instrumented application: the instrumentation hooks, the config and secret handling, the local control surfaces and the data each one captures
Products and areas
Covered by Sorona
-
The brief points at github.com/newrelic for the software New Relic distributes and says it may reward security issues found within its agents that could reduce the security of the application the agent is integrated with, assessed against the default configuration. A Tier One Agents list names what counts: Infrastructure, Browser, Android, iOS, Go, Node.js, Ruby, Unity and PHP, with the Java, .NET and Python agents reached through the compatibility documentation
Products and areas
Covered by Sorona
-
The browser agent (newrelic-browser-agent), a JavaScript snippet injected into customers' production web pages and therefore executing in their end users' browsers
Products and areas
Covered by Sorona
-
The infrastructure agent (newrelic/infrastructure-agent), which runs as a privileged process on every monitored Windows and Linux host and executes integrations that shell out to collect data
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 13
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
https://iopipe.com
Bugcrowd
-
https://newrelic.com/lp/1mind-ai-chat
Bugcrowd
-
https://one.newrelic.com/help-xp - This specific endpoint is excluded from scope
Bugcrowd
-
https://status.newrelic.com
Bugcrowd
-
Anything filed outside Crowdcontrol: Bugcrowd's terms require submissions to go through it exclusively to be considered for a reward
Sorona
-
Denial of service and distributed denial of service against agents or clients
Sorona
-
EOL, unmaintained and unsupported agent versions
Sorona
-
Every github.com/newrelic repository that is not in the Tier One agent list or on docs.newrelic.com, plus New Relic Example Code, New Relic Experimental and archived repos. The organisation holds hundreds of repositories and is nobody's wildcard
Sorona
-
Information disclosure through /status or /metrics URLs without a security impact attached to it
Sorona
-
Leaked API keys with no demonstrated security impact, for which the brief says plainly that no bounty will be paid
Sorona
-
New Relic open source software repos in github.com not in the list of agents or on docs.newrelic.com; New Relic Example Code, New Relic Experimental and Archived repos are explicitly out of scope.
Bugcrowd
-
Reports that refer to a pull request in New Relic's open source projects, which the brief states will not be rewarded
Sorona
-
Services hosted by third-party providers, and issues in Salesforce itself on New Relic's Experience Cloud sites
Sorona
Recent changes
Reward and scope changes across every New Relic program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in New Relic products, from the NVD.
-
CVE-2019-3800 Medium
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
-
CVE-2019-3800 Medium
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
-
CVE-2017-9246 Critical
New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.
-
CVE-2017-9246 Critical
New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.
-
CVE-2013-0284 Medium
Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
-
CVE-2013-0284 Medium
Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
About this page
This page gathers every public program listed under newrelic.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.