OpenObserve bug bounty programs

OpenObserve programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
OP OpenObserve Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• OP

  OpenObserve

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://openobserve.ai

  Web

• Alerts, destinations and templates, which evaluate queries on a schedule and post results to an endpoint a user configured

  Products and areas

• Authentication and session handling, covering local accounts, API tokens, the basic auth path, SSO and single sign-on provisioning

  Products and areas

• Clustering, covering ingester, querier, compactor and router roles and any inter-node request that arrives already trusted

  Products and areas

• Dashboards, folders, saved views and the sharing model, including any dashboard reachable without a session

  Products and areas

• Pipelines and the enrichment tables, which transform records in flight and pull in reference data

  Products and areas

• Stream and schema handling, including dynamic schema inference, field limits and anything that lets ingested data change how later data is stored

  Products and areas

• The ingestion API in full, covering the bulk, JSON, multi, Elasticsearch-compatible, OpenTelemetry, Prometheus remote-write, syslog and Kinesis endpoints, plus the parsers behind each

  Products and areas

• The object storage and local storage backends, including WAL handling, compaction, the file list metadata and the credentials configured for remote storage

  Products and areas

• The organisation and user model in full, covering roles, groups, permissions and every check that decides whether a user reaches a stream, dashboard, alert or pipeline

  Products and areas

• The policy asks for private disclosure of any vulnerability and declares no component carve-out. Everything the platform ships is inside it

  Products and areas

• The query layer end to end: the SQL interface, PromQL, the VRL transform functions and the aggregation cache

  Products and areas

• User-defined VRL functions and the sandbox around them, which run against ingested records inside the server process

  Products and areas

No target matches. Try part of a host name, such as the company name.