Elastic Distributions of OpenTelemetry

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (no EDOT row published; priced on the generic Other row) │ $2,000 │ $2,500 High │ $800 │ $1,000 Medium │ $300 │ $375 Low │ $200 │ $250 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Info disclosure 40 % Code execution 25 % Parsing/validation 20 % Denial of service 10 % Latest advisories Loading the feed Overview EDOT is Elastic's set of OpenTelemetry SDK distributions for Java, Node.js, Python.NET and PHP, and it is small today but structurally important tomorrow. The threat position is the same as any instrumentation library, namely in-process, sees everything, holds a backend credential. pays it on HackerOne, but has not bound a reward row to the EDOT asset, so an award is priced against the program's generic Other row at $200 for a Low up to $2,000 for a Critical, taken conservatively on purpose. sorona.xyz adds 1.25x on top of whatever Elastic awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~11 hours First response ~6 days Triage ~43 days Bounty In scope The declared asset is Elastic Distributions of OpenTelemetry (EDOT), live and bounty-eligible at max severity critical, with no reward row bound to it, so the whole distribution family is accepted and the price is the open question rather than the target The five Elastic-maintained OpenTelemetry SDK distributions, all Apache-2.0: elastic-otel-java , elastic-otel-node , elastic-otel-python , elastic-otel-dotnet and elastic-otel-php , plus the umbrella github.com/elastic/opentelemetry repository Everything Elastic layers on top of the upstream SDKs: inferred spans, runtime metrics, resource attribute providers, the Elastic exporter configuration and the defaults each distribution sets OTLP export paths, covering endpoint handling, credential handling and TLS configuration on the way to the backend The auto-instrumentation attach mechanisms these distributions wrap, including the Java agent premain and runtime attach, the .NET profiler and Node loader hooks The EDOT Collector, which is bounty-eligible on the same asset even though its code ships inside the Elastic-Licensed elastic/elastic-agent and therefore is not an open-source finding Out of scope Reports that reach Elastic by any route other than its own HackerOne program, which the policy makes a condition of bounty eligibility Upstream open-telemetry/* code that Elastic merely repackages, since 'security issues in third party systems, domains, services and components fall outside this policy and are not eligible for a bounty'; an upstream OpenTelemetry bug belongs to OpenTelemetry The EDOT Collector's Elastic-Licensed code for open-source classification purposes, though it stays bounty-eligible End-of-life distribution versions rather than a currently supported release Volumetric denial of service, which the policy rules out permanently Known-vulnerable-dependency reports filed without a working proof of concept Elastic's classic APM agents, which are a separate scope asset on their own bounty row Most-valued findings A leak of the OTLP endpoint credential or exporter configuration out of the instrumented process, the dominant class at 40% and the finding that turns an instrumentation library into a route to the observability backend Code execution reached through an Elastic-specific extension or through the auto-instrumentation attach path the distribution wraps A sanitisation or attribute-handling failure in Elastic's additions that pushes secrets, headers or request bodies into telemetry that is read far more widely than the application Parsing or validation flaws in the Elastic-added span, metric and resource handling, at 20% of the expected profile Anything that lets configuration fetched at runtime change what the instrumented application executes Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. EDOT is a live, bounty-eligible asset with max severity critical, but no reward row is bound to it, so treat the generic Other row as the working figure until Elastic publishes one Route findings that land in the Apache-2.0 language SDK repositories; the EDOT Collector ships inside elastic/elastic-agent , which is Elastic License 2.0 only and is not open source even though it is still bounty-eligible The bug has to be in what Elastic added or changed, because upstream open-telemetry/* code is a third-party component under this policy Reproduce on a currently supported release; EOL versions are out of scope Volumetric denial of service is never eligible, and a known-vulnerable-dependency report needs a working proof of concept Program stats 891 Reports resolved $986k Bounties paid 79% Response efficiency Disclosure Coordinated by Elastic, which publishes outcomes as Elastic Security Advisories under its own CNA. Bounty eligibility is conditional on the report being submitted exclusively through Elastic's own program, so file there first and treat sorona.xyz as the follow-on rail. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability