below

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Access control 45 % Code execution 25 % Info disclosure 20 % Denial of service 5 % Latest advisories Loading the feed Overview below is a cgroup2-based resource monitor for Linux, written in Rust, that runs as a privileged long-lived daemon recording per-cgroup resource history. It is packaged in Fedora and several other distributions, so it reaches well beyond Meta's own fleet. Being Rust does not make its security profile a memory-safety one: the interesting surface is a root daemon writing to predictable filesystem paths on machines where ordinary users also have accounts, which is why the recorded distribution leads with access control at 45% rather than memory safety. Its single CVE illustrates the point exactly: CVE-2025-27591 was a local privilege escalation caused by a world-writable directory under /var/log/below . Meta pays cash for a report with a published minimum of $500, determines severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebookincubator/below sits under the second, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source The recording daemon in full: the collection loop, the cgroup2 and procfs readers behind it, and everything the process does while running as root The store under /var/log/below : the directories and files it creates, the ownership and permission modes it sets on them, and the compressed history format it writes The replay side, meaning the record, live, replay, snapshot and dump subcommands and the code that reads back a store an earlier privileged run produced The terminal UI, the dump subcommand's output formatters, and the configuration file the daemon and CLI both read The systemd unit the project ships and any interface it leaves open between an unprivileged account and the long-lived root process The Rust crates that make up the repository, unsafe blocks and C bindings included Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Defects in a distribution's packaging of below, its unit files or install paths, rather than in the project's own code Attacks that start from root, which sits inside the trust boundary this project defends Most-valued findings Local privilege escalation from an ordinary account to root through a path the daemon creates or writes. That is the whole of below's CVE record: CVE-2025-27591 was a world-writable directory under /var/log/below A symlink, hardlink or time-of-check-to-time-of-use race against the root writer that redirects a privileged write onto a file the attacker chose Code execution as root reached from replaying the stored history, since the daemon trusts data an earlier privileged run wrote Exposure of per-cgroup resource history to accounts that should not have it, a side channel on a shared host into what every other workload is doing Anything above demonstrated against the build a distribution actually ships, Fedora's in particular, rather than a local build with different install paths Being Rust buys less here than it looks. The recorded distribution leads with access control at 45%, so spend the time on ownership, modes and races rather than on hunting for memory corruption Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so show the escalation actually completing rather than stopping at a permissive mode bit Both https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible prefixes, and below sits under the second one Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability