VictoriaMetrics bug bounty programs

VictoriaMetrics programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
VI VictoriaMetrics Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• VI

  VictoriaMetrics

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://victoriametrics.com

  Web

• Backup and restore against object storage, including how the credentials for it are handled

  Products and areas

• Ingestion in full, covering Prometheus remote write and the compatibility endpoints for Influx line protocol, Graphite, OpenTSDB and other formats the suite accepts

  Products and areas

• The authentication and routing proxy shipped with the suite, and the rules it uses to decide what a caller may reach

  Products and areas

• The bundled web interface and everything reachable from it

  Products and areas

• The cluster build and the separation between the ingestion, storage and query tiers, including the inter-component calls each tier accepts

  Products and areas

• The documented policy asks for any security issue by email to the security alias, reinforced by a signed security.txt naming the same contact. It states no scope boundary, so the whole suite is in

  Products and areas

• The Helm charts and the Kubernetes operator, which is how most of these deployments are actually configured

  Products and areas

• The multi-tenancy boundary in the cluster build, where a tenant identifier in the request decides whose series are read, written or deleted

  Products and areas

• The on-disk data format and what happens when a process opens data it did not write

  Products and areas

• The query layer end to end: PromQL and MetricsQL parsing, evaluation and the query APIs that dashboards talk to

  Products and areas

• The single-node database and its entire HTTP surface, including the administrative and debug routes

  Products and areas

• VictoriaLogs, its ingest paths and its query surface

  Products and areas

• vmagent, including scrape configuration, service discovery and the credentials it holds for both targets and remote-write destinations

  Products and areas

• vmalert, its rule evaluation and its connections to the alert manager and to notification endpoints

  Products and areas

No target matches. Try part of a host name, such as the company name.