- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://www.lightdash.com
Products and areas 12
- Authentication in full: password login, Google, Okta, Azure AD, OneLogin and generic OIDC, plus the account provisioning and identity linking that follows an assertion
- Query generation and execution, covering the explore and metric layer, custom dimensions, custom metrics, filters and the SQL runner
- Scheduled deliveries and alerts, which run queries unattended and send results to Slack, email or a webhook a user configured
- Server-side rendering for scheduled images and PDFs, where the product loads its own pages in a headless browser
- Sharing: share links, public dashboard URLs, embedded dashboards and the signed tokens behind embedding, all of which reach viewers outside the normal permission model
- The dbt integration: repository access, the tokens and deploy keys Lightdash holds for GitHub, GitLab, Bitbucket and Azure DevOps, and the project compilation that reads a repository's contents
- The full API surface and the session, cookie and CSRF handling in front of it, along with personal access tokens and the service account paths
- The organisation, project and space model in full, covering membership, roles, invitations and every check that decides whether a user reaches a dashboard, chart, space or project
- The policy asks for any vulnerability report at the project security address and commits to a remediation window rather than declaring a component boundary. The whole product is in scope, and the stale supported-versions table is not a scope statement
- The self-hosted deployment path, including the environment configuration and the initial setup flow
- The SQL runner specifically, which lets a permitted user write arbitrary SQL against a connected warehouse
- Warehouse connection handling for every supported engine, including connection parameters, credential storage, encryption and the connection test path
Out of scope (6)
- Access an organisation admin granted deliberately, including SQL runner rights on a connected warehouse
- A self-hosted deployment left with default secrets or no authentication in front of it, which is an operator decision
- dbt itself and the warehouse engines behind it, each of which has its own vendor process
- Lightdash Cloud's hosting infrastructure rather than the product code
- Public GitHub issues, which are not a private channel for a security report
- Upstream dependencies, unless Lightdash's own use of them is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Email the address on the policy page , the address in SECURITY.md. GitHub private vulnerability reporting is also enabled on lightdash/lightdash , so either private route works
-
Ignore the supported-versions table in the policy. It still lists 0.4.x and is years out of date, so report against a current release and name the version
-
Do not open a public GitHub issue for a security bug
-
The policy states that vulnerabilities classified as high or above will be remedied within seven days, so expect a fast fix cycle and plan your disclosure timing around it
-
Say whether you tested self-hosted Lightdash or the cloud product, and which warehouse was connected. Most of the query surface only exists once a real warehouse is attached
-
State the attacker's role and their organisation and project membership. Every interesting boundary in this product is a tenancy boundary, so being precise about the starting point decides severity
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-35844 | packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used. | High 7.5 | 19 Jun 2023 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 3 Last 12 months Access control 40 % Credential handling 25 % Info disclosure 20 % SSRF 15 % Latest advisories Loading the feed Overview Lightdash is a BI layer built directly on dbt, so a company's metric definitions and its warehouse credentials both live inside it, and the dashboards it serves reach whoever a project owner invited. Three advisories landed in the last twelve months, two of them carrying CVEs, on a product where the entire security question is whether one project's data stays out of another user's browser. The policy commits to remediating anything high or above within seven days. It commits to nothing in return: no bounty or reward language appears in the policy, on the vendor site or in its trust centre. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy asks for any vulnerability report at the project security address and commits to a remediation window rather than declaring a component boundary. The whole product is in scope, and the stale supported-versions table is not a scope statement The organisation, project and space model in full, covering membership, roles, invitations and every check that decides whether a user reaches a dashboard, chart, space or project Warehouse connection handling for every supported engine, including connection parameters, credential storage, encryption and the connection test path The dbt integration: repository access, the tokens and deploy keys Lightdash holds for GitHub, GitLab, Bitbucket and Azure DevOps, and the project compilation that reads a repository's contents Query generation and execution, covering the explore and metric layer, custom dimensions, custom metrics, filters and the SQL runner The SQL runner specifically, which lets a permitted user write arbitrary SQL against a connected warehouse Sharing: share links, public dashboard URLs, embedded dashboards and the signed tokens behind embedding, all of which reach viewers outside the normal permission model The full API surface and the session, cookie and CSRF handling in front of it, along with personal access tokens and the service account paths Authentication in full: password login, Google, Okta, Azure AD, OneLogin and generic OIDC, plus the account provisioning and identity linking that follows an assertion Scheduled deliveries and alerts, which run queries unattended and send results to Slack, email or a webhook a user configured Server-side rendering for scheduled images and PDFs, where the product loads its own pages in a headless browser The self-hosted deployment path, including the environment configuration and the initial setup flow Out of scope Lightdash Cloud's hosting infrastructure rather than the product code dbt itself and the warehouse engines behind it, each of which has its own vendor process Access an organisation admin granted deliberately, including SQL runner rights on a connected warehouse A self-hosted deployment left with default secrets or no authentication in front of it, which is an operator decision Upstream dependencies, unless Lightdash's own use of them is what makes the defect reachable Public GitHub issues, which are not a private channel for a security report Most-valued findings Cross-tenant access in any direction: reaching a project, space, dashboard or chart belonging to an organisation you are not a member of. On a multi-tenant BI product this is the whole security model in one class Anything that returns a stored warehouse credential, a Git access token or a deploy key to a user who should only see query results. Lightdash holds both the data credentials and the source repository credentials SQL runner and query generation defects where a filter, a custom metric or a custom dimension escapes the generated query and reaches tables the user's project excludes Sharing and embedding defects, where a share link, a public dashboard identifier or a signed embed token reaches content outside what was published. These endpoints are the ones intended for people outside the tenancy Role escalation inside an organisation, viewer to editor to admin, on a product where admin means the warehouse connection Server-side request forgery through warehouse connection setup, webhook delivery or the headless browser that renders scheduled deliveries Identity binding in the SSO paths, where an attacker-controlled assertion attaches to an existing account and inherits its project access Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] , the address in SECURITY.md. GitHub private vulnerability reporting is also enabled on lightdash/lightdash , so either private route works Ignore the supported-versions table in the policy. It still lists 0.4.x and is years out of date, so report against a current release and name the version Do not open a public GitHub issue for a security bug The policy states that vulnerabilities classified as high or above will be remedied within seven days, so expect a fast fix cycle and plan your disclosure timing around it Nothing is paid. There is no bounty language in the policy, on the security page or in the Oneleet trust centre the vendor links to Say whether you tested self-hosted Lightdash or the cloud product, and which warehouse was connected. Most of the query surface only exists once a real warehouse is attached State the attacker's role and their organisation and project membership. Every interesting boundary in this product is a tenancy boundary, so being precise about the starting point decides severity Disclosure Coordinated privately by email or through GitHub private vulnerability reporting, and published as a GitHub Security Advisory. The project's own remediation target is seven days for anything high or above, and the recent advisories carry CVEs, so expect a fix in a release quickly and an advisory shortly after. Hold detail until the advisory is public. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability