Neon

Overview

Neon is an open-source database company dedicated to delivering a serverless PostgreSQL platform optimized for cloud deployment. Our architecture separates storage and compute, enabling features like autoscaling, instant branching, and bottomless storage. Committed to continuous development, we regularly release new features and enhancements, providing ongoing opportunities for security testing. We invite researchers to collaborate with us in identifying and addressing potential vulnerabilities, ensuring our platform remains robust and secure.

Time to resolution varies by complexity and severity.

For a comprehensive list of API endpoints to guide your testing, see: {F4002038}

This program has enabled HackerOne's Strict Signal Requirements for report submissions. Signal scores are calculated and managed by HackerOne, not by our team — if you're unable to submit a report or have questions about the requirement, please contact HackerOne Support directly.

Neon Supported Postgres Extensions

Neon supports a curated set of open source Postgres extensions. Because we curate, ship, and allow-list these extensions, vulnerabilities in extension code that can be used to escalate privileges on Neon are in scope and rewarded under the extension bounty table. Bugs that affect the extension only outside our managed platform are upstream third-party code and out of scope.

We take extension privilege escalation seriously and address every valid report, whether the escalation abuses objects installed by our platform role or a flaw in the extension's own code. Where possible, we fix at the platform level, closing whole techniques at once rather than patching report by report.

How we rate these reports. Neon compute is single-tenant: it serves one project, runs in its own VM, and holds credentials scoped to that tenant. Reaching cloud_admin / Postgres superuser / OS-level code execution inside your own compute is therefore rated and paid at the Supported-Extensions tiers, regardless of the raw CVSS score. We rate based on the boundary crossed, not on the initial database role.

Disclosure Policy

• Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from us. Disclosure of reports within Hacker0ne can be discussed.
• Follow HackerOne's disclosure guidelines.

Eligible Vulnerabilities

To qualify for rewards, the following criteria must be met:

• You must be the first to report the vulnerability.
• Reports must include full reproduction details and be reproducible on in-scope assets.
• Vulnerabilities should affect recent versions of supported browsers or applications (e.g., Microsoft Edge, Chrome 111, Firefox 111, Safari 15).
• Qualification of vulnerabilities is at Neon's sole discretion.

NOTE Neon has been acquired by Databricks, and we maintain two distinct bug bounty programs. It is important to note that Neon and Lakebase share a common codebase; consequently, we can accept a vulnerability report only once across both platforms.

We welcome reports of:

• Leaked credentials of Neon employees that could grant unauthorized access or expose sensitive information. We do not award reports for leaked credentials of our customers because Neon is a GitHub Secret Scanning partner, which means GitHub automatically scans for and reports leaked credentials associated with our platform. We have an internal process to notify affected customers directly.
• Any issue allowing unauthorized access, modification, or data exposure.

Out of Scope

To keep things efficient and reduce unnecessary noise for the Neon team, please exclude the following forms from your tests:

• Feedback Form
• Support Form
• Request Private Networking Form

Known Vulnerabilities

We're aware of the following vulnerabilities and do not award these reports unless you can combine multiple vulnerabilities to have a bigger impact:

• CSRF
• HTML injection
• Invalid Session termination

Staging vs Prod Environments

While production systems are in scope, we ask that researchers use our staging environment for all security testing. Staging is a replica of production and supports the same features, including paid account functionality via test credit cards.

Staging Access : Sign up at https://console-stage.neon.build/ using preview code / invite code I-LOVE-PREVIEWS ( https://console-stage.neon.build/?invite=I-LOVE-PREVIEWS ), and please use your @wearehackerone.com email so we can identify testing activity. For staging, you can upgrade plans using Stripe test cards. (https://docs.stripe.com/testing) .

If your testing requires something specific to production, please alert us at [email protected] before proceeding so we can coordinate and minimize any impact to live users and data. If you have questions about this or anything else, feel free to reach out at the same address!

Non-Qualifying Vulnerabilities and Exclusions

In addition to the "Hackerone's Core Ineligible Findings" list, the following are considered out of scope unless a proof-of-concept (PoC) demonstrates exploitability:

• Unfixed issues in third-party components (vendor-dependent).
• Missing "best practices" that do not introduce a security vulnerability.
• Rate limiting (please avoid excessive testing, as it may trigger alerts).
• Vulnerable libraries without a PoC.
• User enumeration via account creation, authentication, or password recovery.

Note: We cannot reward or work with individuals on U.S. sanction lists or residing in sanctioned countries. This includes, but is not limited to, residents of Iran, North Korea, Syria, Crimea region of Ukraine. Severity level is at the sole discretion of the Neon security team.

Rules of Engagement

Please adhere to the following rules to ensure compliance with the program:

• Use a unique header with your HackerOne username (X-Bug-Bounty:HackerOne-username) in requests to help us identify your testing.
• Do not attempt to view, alter, or damage data belonging to other users. If necessary, create a test account to verify vulnerabilities.
• Avoid excessive automated scanning; keep requests to 10 per second or lower to prevent potential service impact.
• Do not discuss or share details of any vulnerability, even resolved ones, outside the HackerOne platform until officially approved for disclosure.
• Refrain from attempting denial-of-service attacks or similar actions that could disrupt our services.
• Use the HackerOne platform for all correspondence regarding your testing and findings.

Important: Use your HackerOne email alias (e.g., [email protected]) when creating accounts, so we can recognize legitimate testing accounts. If you run security scans against Neon's systems without using your @wearehackerone.com email address, your email may be blocked. Please ensure you use your HackerOne email when testing.

Neon reserves the right to change program terms at any time.

For vulnerabilities involving information disclosure, avoid capturing or retaining personally identifiable information (PII). If you inadvertently access or alter any PII, stop testing immediately and report the issue along with reproduction steps to help our team assess the impact.

When possible, please employ methods that confirm elevated access without exposing PII. Examples include:

• Screenshots of navigation bar options or pages without PII that weren’t originally viewable.
• Improper access to another account you control.

Attributes of a Good Report and Bug Bounty Rewards

Provide detailed, clear reporting with screenshots, proof-of-concept code, and steps to reproduce. Rewards reflect the impact, severity, and creativity of the vulnerability discovered. Bug bounty rewards are solely at Neon’s discretion, based on the severity and creativity of the bug.