Countly

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Medium severity and above: a bounty reward is committed in writing, but no amount is published anywhere (Low earns nothing) │ not published │ not published Submit a vulnerability CVE history 4 Last 12 months 2 Lifetime XSS 35 % Injection 25 % Access control 25 % Info disclosure 10 % Latest advisories Loading the feed Overview Countly is a self-hosted product analytics server, run by organisations whose data-residency requirements rule out Mixpanel or Amplitude — mobile-heavy markets and regulated sectors in particular. Its install base is modest next to Matomo or PostHog, but what it holds is out of proportion to its size: per-device and per-user behavioural event streams, device identifiers, session histories and whatever custom properties an application decided to attach, for every app wired into the instance. It also accepts unauthenticated writes on its SDK ingest path from the open internet by design. A tenancy or access-control failure here is a data-protection incident covering an entire behavioural dataset rather than an outage. Countly runs its own bounty directly out of the repository's SECURITY.md, and the scope is unusually clean because it is the repository itself: "Bounty assessment is made against the current code in this repository." The cash commitment is unambiguous — "All software related security bugs with severity of medium and higher will be awarded accordingly with a bug bounty reward" — but no amount is published anywhere, so there is no ceiling to quote and we will not invent one; Low severity is stated to earn nothing at all. Agree a figure with [email protected] in writing before you count on it. sorona.xyz adds 1.25× on top of whatever Countly awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Countly's SECURITY.md sets the target as the repository itself: "Bounty assessment is made against the current code in this repository." That repository is Countly/countly-server , and any software security bug in it at medium severity or above is stated to earn a reward The Node.js API server: the write path at /i and /i/bulk , the read path at /o , and the request parsing and validation in front of both The SDK ingest surface, which takes event, session, crash and user-property data from mobile and web SDKs across the open internet without authentication Authentication and session handling for the dashboard, plus the auth tokens and API keys that stand in for a session on the API The member, group and permission model, and the app-level boundary meant to keep one application's data away from another's operators The dashboard: its views, its widgets, and every place operator-supplied or event-supplied strings are rendered back The query layer that turns dashboard filters and API parameters into MongoDB queries and aggregations Data export, report generation and the raw-data API, which move a whole behavioural dataset out of the instance The plugin framework and the plugins enabled by default, meaning those listed in plugins/plugins.default.json Out of scope Any plugin not listed in plugins/plugins.default.json , which the policy states are out of scope regardless of what they do Low-severity findings, which the policy states earn no bounty reward XSS without demonstrated execution in an authenticated dashboard session Additional instances of a vulnerability class already being remediated, including work visible only in an open pull request or an unmerged branch Countly's hosted Enterprise offering, which is not "the current code in this repository" MongoDB, Node.js and the npm dependencies Countly builds on, which belong to their own projects Most-valued findings A cross-tenant access-control failure in the dashboard's role and permission model that lets one application's operator read or write another's event stream. Access control is 25% of the expected distribution, and this is the finding that converts a single account into every dataset on the instance Anything on /i or /i/bulk that an unauthenticated caller can push past event ingestion into query, storage or execution, since those endpoints face the open internet by design and take attacker-controlled structure as their normal input Stored XSS that executes in an authenticated dashboard session, which is the largest class here at 35% and the only XSS shape the program will pay for Injection into the raw-data, export or report-generation paths, the 25% class and the route by which a query becomes a dump of the whole behavioural dataset Authentication or session-handling bypass on the dashboard, which needs no chaining to be worth the top band the program is willing to pay Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Reports go to [email protected] , not to GitHub issues Bounty assessment is made against the current code in the countly-server repository, so the hosted Enterprise offering is a different question Low severity pays nothing at all: the policy states "Low - no bounty rewards" XSS has to demonstrate execution in an authenticated dashboard session; a payload that only reflects is not a finding here Findings that are additional instances of a vulnerability class Countly is already remediating, including work visible in an open pull request, a public branch or another not-yet-released fix, are not separately eligible No dollar amount is published anywhere, so confirm the reward band with [email protected] in writing before committing time Disclosure Coordinated privately with [email protected] . The routing position is one of the cleanest anywhere: nothing in SECURITY.md or on the site restricts third-party involvement, resale, exclusivity or IP. The trade-off is that there is no platform to arbitrate a dispute and a single email address is the entire intake, so get the timeline and the amount confirmed in writing rather than assumed. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability