Prefect bug bounty programs

Prefect programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
PR Prefect Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• PR

  Prefect

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://www.prefect.io

  Web

• Artifacts, logs and flow run metadata, covering anything that renders content a flow produced

  Products and areas

• Blocks in full: block registration, the credential and storage block types, secret handling, and how a block's contents reach a worker process

  Products and areas

• Deployments and work pools, covering the pull steps that fetch flow code from git, S3 or another remote store before a run starts

  Products and areas

• Result storage and serialisation, including the pickle-backed result serializer and every path where a run reads back a result another run wrote

  Products and areas

• The CLI, the client library and the profile and API key handling behind them

  Products and areas

• The event and automation system, including triggers, webhooks that accept an inbound request, and the actions an automation can perform

  Products and areas

• The orchestration engine, covering flow and task run state transitions, retries, cancellation and the concurrency limit machinery

  Products and areas

• The Prefect Server API in full: every REST route, the authentication layer in front of it, and the authorisation checks that separate one workspace or tenant from another

  Products and areas

• The published policy asks for any security vulnerability privately through the repository's advisory workflow, and names a short explicit out-of-scope list. Everything below sits inside what it accepts

  Products and areas

• The web UI and the API it talks to, including every place run or deployment metadata becomes rendered HTML

  Products and areas

• The worker and agent processes and the infrastructure integrations that launch runs on Docker, Kubernetes, ECS and Cloud Run

  Products and areas

• Variables, the task-run cache and any shared state a flow can read that another flow wrote

  Products and areas

No target matches. Try part of a host name, such as the company name.