Folly

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 3 Lifetime Memory safety 50 % Denial of service 25 % Parsing/validation 15 % Info disclosure 5 % Latest advisories Loading the feed Overview Folly is the C++ substrate almost everything else Meta open-sources is built on: Proxygen, mvfst, fizz, wangle, fbthrift, Watchman, HHVM, Velox and CacheLib all depend on it. Its direct third-party adoption is modest, and that is the wrong number to look at: the important one is the transitive footprint, because a memory-safety defect in Folly is a fan-out defect that can surface in an HTTP stack, a QUIC stack, a TLS stack and a query engine simultaneously. Half of Folly's recorded CVE history is memory safety, which follows from what it is: hand-tuned containers, buffer chains and conversion routines that every layer above it pushes attacker-controlled bytes through. Meta pays cash for a report on its own bug bounty, with a published minimum of $500, severity set by Meta, and no payout guideline covering open source, so no maximum award is published in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/folly sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source The container and string types: fbstring , the F14 maps and sets, small_vector , the sorted-vector types and Range / StringPiece IOBuf and IOBufQueue , the buffer layer every Meta network stack moves bytes through, along with the cursors and codec wrappers in folly::io Parsing and formatting: folly::dynamic , the JSON and JSON-pointer code, URI parsing, the to<> conversions and the format library The async and networking layer in folly::io::async : the event base, the socket and SSL socket wrappers, and the timeout machinery Concurrency primitives: futures, executors, Synchronized , hazard pointers and the lock-free queues Memory, allocator and arithmetic helpers, including the size and capacity computations that later feed an allocation or a copy The hashing, portability and cryptographic helper code the library ships Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, which Meta scores low even for a library this central Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Defects that turn out to live in a downstream consumer, Proxygen, mvfst, fizz, Velox or CacheLib, each of which is its own repository with its own entry under the same program Application-side API misuse: documented preconditions violated, return values ignored, or a Folly type handed state the caller already invalidated Build-configuration and portability problems, compiler warnings, and sanitizer output submitted with no reproducing input Most-valued findings Remote-reachable memory corruption in IOBuf or the container and string types, demonstrated through a downstream stack. Memory safety is 50% of Folly's history, and one Folly bug that lands in Proxygen or mvfst has several exploitable front doors A parsing defect in folly::dynamic or the JSON decoder driven by bytes an unauthenticated caller controls Integer overflow in size or capacity arithmetic that becomes an undersized allocation and then a heap overflow Use-after-free or a lifetime violation in the futures and executor machinery that an attacker steers deterministically by timing requests Any of the above reaching a service Meta actually operates, since Meta prices reports on impact to Meta users and systems rather than on library ubiquity Three CVEs lifetime (CVE-2018-6337, CVE-2019-11934, CVE-2021-24036) is thin for a library carrying this much traffic. Read it as a statement about who has looked rather than about what is there Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so show the Folly defect reaching something Meta runs rather than stopping at the library boundary Only repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible; facebook/folly qualifies under the first Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability