Buck2

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Code execution 35 % Access control 25 % Parsing/validation 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Buck2 is Meta's large-scale build system, written in Rust, and it builds most of Meta's monorepo. External adoption is real but still early, and its user count is the wrong measure of what a bug here is worth. The right measure is category: a build system executes arbitrary toolchain code, evaluates build definitions that arrive with any repository you check out, resolves and downloads remote dependencies, and drives remote execution workers and a shared action cache. Those are supply-chain bug classes. A sandbox escape or a dependency-resolution confusion in a build system converts directly into code execution on build infrastructure, and a poisoned cache entry propagates to everyone who builds afterwards. Meta pays cash for a report on its own bug bounty with a published minimum of $500, sets severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/buck2 sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source The buck2 client and the daemon behind it, including the control channel between them and the privilege boundary separating the daemon from the user who invoked it Starlark evaluation: BUCK files, .bzl rule definitions, macros and the prelude, all of which arrive with any repository a developer checks out The action execution layer, covering local execution, the sandbox and isolation model, and the remote-execution client that talks to build workers The action cache and the content-addressable store: digests, cache keys, uploads, downloads and the integrity checking around them Dependency and toolchain resolution, including download paths, artifact verification and how an internal name is told apart from an external one Filesystem handling across the build root: input materialisation, output paths, symlinks and the temporary directories actions run in Credential and token handling for remote-execution and cache backends, and whatever reaches logs, build outputs and the daemon's own state Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Defects in a toolchain buck2 invokes, a compiler, a linker or a packaging tool, which belong to that tool's own project The fact that a build definition runs code by design. A report has to show a trust boundary being crossed Build correctness, incrementality and cache-invalidation bugs with no security consequence Most-valued findings Code execution on build infrastructure from an input the build merely consumed. On a build system that is a supply-chain compromise rather than a single-host one Remote-cache or action-digest poisoning, where one attacker-controlled entry is then served to every build that follows Sandbox escape from a build action into the worker, converting an untrusted dependency into a persistent foothold Dependency-resolution confusion that substitutes an attacker's artifact for the intended one without tripping integrity checking Leakage of remote-execution credentials or build secrets into logs, outputs or the shared cache, which hands over the keys to the whole pipeline Buck2 has no CVE record at all, so this ordering follows what build systems fail at rather than what buck2 has already failed at. Code execution carries 35% of the expected distribution and it is the class worth the first week Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source, and the mobile guideline often quoted for this program requires an Android or iOS proof of concept a build tool cannot supply Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so show the trust boundary a build genuinely crosses rather than the fact that builds run code by design Only repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible; facebook/buck2 qualifies under the first Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Build-infrastructure findings tend to need remote-execution and cache backends patched before anything is said publicly, so expect the window to run long. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability