Backstage

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Core Backstage source-code asset) │ $8,000 │ $9,000 High (Core) │ $4,000 │ $5,000 Medium (Core) │ $700 │ $875 Low (Core) │ $500 │ $625 Non-Core monorepo components (asset capped at medium severity) │ $100 - $200 │ $125 - $250 Submit a vulnerability CVE history 14 Last 12 months 20 Lifetime Access control 35 % Auth bypass 25 % Info disclosure 20 % Injection 15 % Latest advisories Loading the feed Overview Backstage is the de facto standard internal developer portal: a CNCF Incubating project donated by Spotify in 2020 and deployed inside a large share of the Fortune 500 engineering organisations that adopted platform engineering, including American Airlines, Netflix, Expedia, HP, Splunk, Zalando, Vodafone and Twilio, plus the commercial distributions built on top of it: Red Hat Developer Hub, Spotify Portal for Backstage, Roadie and Frontside. What makes its blast radius unusual is what a developer portal holds: it federates the software catalog, CI/CD triggers, cloud credentials through plugin proxies, Kubernetes cluster views and SSO identity for an entire engineering organisation, so a catalog or auth-backend flaw is a lateral-movement primitive across every system the portal fronts, and Red Hat shipping it as a supported product puts it inside regulated enterprises that would never install an upstream OSS portal directly. Spotify pays for it on HackerOne and names the GitHub repository itself as a source-code asset in the top reward tier: $500 at Low up to $8,000 at Critical for packages on the enumerated Core list, with the rest of the monorepo paid on the Non-Core row and capped at medium severity, which puts it at $100 to $200. sorona.xyz adds 1.25x on top of whatever Spotify awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~5 days First response not published Triage ~42 days Bounty In scope Spotify's program names the Backstage repository itself, twice over. Core Backstage source code covers the packages on Spotify's enumerated Core list at critical severity on the Core reward row, $500 to $8,000. A second row, https://github.com/backstage/backstage , covers every component of the repo that is not on that list, paid on the Non-Core row and capped at medium. The whole open-source monorepo is bounty-eligible and only the tier differs The Core packages Spotify enumerates one by one: @backstage/backend-defaults , @backstage/backend-plugin-api , @backstage/catalog-client , @backstage/catalog-model , @backstage/cli , @backstage/config , app-defaults , backend-common , backend-test-utils and the rest of that list The backend framework: service and plugin initialisation, the HTTP router, the database and cache services, and the isolation the backend system puts between plugins Authentication and identity in auth-backend : the OAuth and OIDC providers it ships, the sign-in resolvers, and the Backstage tokens issued off the back of them The permission framework and its policy evaluation, which decides what an authenticated portal user may see and do The software catalog: entity ingestion, processors and providers, the entity model and its validation, and the catalog API Scaffolder: template parsing, parameter handling, and the actions that execute against real repositories and real infrastructure The proxy backend and the SCM integrations package, which broker GitHub, GitLab, Bitbucket and Azure credentials on behalf of the signed-in user TechDocs, Search, the Kubernetes plugin and the other plugins shipped in-tree, all bounty-eligible as Non-Core components of the monorepo Configuration loading, including secret resolution and the split between backend config and what the frontend is allowed to read The frontend app packages and core-app-api , plus the @backstage/cli with its dev server and build pipeline backstage.io , the documentation site, listed as its own Non-Core asset capped at medium severity Out of scope Third-party Backstage plugins that do not ship inside the monorepo, which fall under Spotify's Third Party Dependencies section and are not authorised for research Findings that require a misconfigured, internet-exposed Backstage instance, since the threat model assumes a protected internal deployment and severity is scored against it Non-Core components reported above medium, since that asset's maximum severity is medium no matter how the finding is scored, which puts the practical band there at $100 to $200 Reports of compromised accounts, breach dumps and publicly accessible password dumps Fingerprinting and banner disclosure, and the presence of known public files or directories such as robots.txt Third-party managed *.withspotify.com style sites, which are capped at a flat $100 informational bonus Spotify's other assets on the same program, the WhoSampled site among them, which are separate scope rows rather than part of Backstage Most-valued findings Access-control failures in the software catalog or the plugin proxies that let one user read or act on entities, credentials or clusters belonging to another, the 35% top class here and the surface the $8,000 Core Critical figure is really aimed at Authentication bypass in auth-backend that produces a valid Backstage identity without valid SSO, which turns the portal into an entry point rather than a directory Scaffolder template flaws that execute an action against infrastructure the requester was never entitled to touch, one of the two classes that dominate the last twelve months of advisories Information disclosure that crosses the tenant or ownership boundary in the catalog, exposing service ownership, secrets in entity metadata, or the internal topology the portal exists to describe Injection in a Core package's handling of catalog entities, configuration or CLI input, reachable by an ordinary authenticated portal user Any of the above located in a package on the enumerated Core list, since the same bug in a Non-Core component is capped at medium and pays a fraction as much Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Which reward row you land on depends on whether the affected package is on Spotify's enumerated Core Backstage list; everything else in the monorepo is Non-Core and caps at medium severity Severity is scored against Backstage's own threat model, which assumes an internal, protected deployment rather than an internet-exposed one, and that assumption depresses realised payouts A finding that only works because someone exposed Backstage to the public internet argues against the threat model, so carry the impact back to an internal attacker if you want it paid Spotify's Third Party Dependencies section declines to authorise research on third-party products, so plugins that do not ship in the monorepo are not yours to test under this program Do not disclose the issue or the report to anyone without Spotify's permission: the clause covers both the vulnerability and the report itself Third-party managed *.withspotify.com style sites pay a flat $100 informational bonus only, whatever you find there Program stats 1,662 Reports resolved $735k Bounties paid 57% Response efficiency Disclosure File this one directly with Spotify through HackerOne. The policy bars disclosure of an issue to the public or to any third party without Spotify's permission, and separately bars disclosure of the report itself, so a sorona.xyz-routed report can be read as breaching it on both counts. Spotify's own resolution pace is slow, first response averages about five days and bounties about six weeks, so expect the embargo to run for a while. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability