Netflix Atlas

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Secondary Target, not the $25,000 Primary tier) │ $5,000 │ $6,000 High │ $2,000 │ $2,500 Medium │ $600 │ $750 Low (below the Secondary tier floor, not rewarded) │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Injection 35 % Denial of service 30 % Info disclosure 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview Atlas is the telemetry backbone of Netflix itself, ingesting the operational metrics for one of the largest production estates on the public internet, and it is the reference implementation of the dimensional in-memory time-series design that later influenced Prometheus and M3. Outside Netflix its footprint is narrower than its 3,558 GitHub stars suggest, it runs at organisations that adopted the Netflix OSS stack wholesale, and it is the backend spectator publishes into by default, but its security position is positional rather than numerical: an Atlas instance holds the full operational telemetry of the estate that runs it, so an info-disclosure or query-injection bug reads out a map of the entire infrastructure, and a denial of service blinds the operator in the middle of an incident. It also parses a Graphite-compatible wire protocol accepted from a very large number of low-privilege hosts. Netflix runs no hosted Atlas product at all, so the repository is the only testable asset, and it pays on the Secondary Target scale: $600 at Medium, $2,000 at High and $5,000 at Critical. sorona.xyz adds 1.25x on top of whatever Netflix awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~2 hours First response 7 days (Netflix's published confirmation commitment) Triage ~7 days Bounty In scope Two structured SOURCE_CODE scope rows carry github.com/Netflix/atlas , both bounty-eligible at a maximum severity of critical and both marked Secondary Target, so the declared asset is the repository rather than any component of it The Atlas server as shipped: the in-memory dimensional time-series store, its indexing and retention behaviour, and the query engine that reads it The Atlas Stack Language in full, meaning the expression parser, the evaluator and the operator library exposed to callers The HTTP API as implemented in the repository, including /api/v1/graph , /api/v1/tags and /api/v1/publish , together with the Akka/Pekko layer serving them The ingest path: the JSON and Graphite-compatible wire codecs that take metric data from publishing hosts Chart and image rendering in atlas-chart , which turns query output into PNG and SVG Every module in the repository's build, since the scope rows name the whole repo, and Netflix runs no hosted Atlas product a researcher could point at instead Out of scope Every other Netflix open source project: the policy states that all other Netflix open source projects are not in scope for reward at this time, and the Open Source Targets Overview lists only Zuul, Atlas and Spectator Dispatch OSS, which the program names explicitly in its Out-of-Scope section Third-party websites or systems hosted by anyone other than Netflix, including somebody else's Atlas deployment Findings below Medium severity. The Secondary tier has no Low row, so they are not rewarded at all Reward is conditional on Netflix pursuing a change based on the submission, so a valid finding it chooses not to act on pays nothing Duplicates: you have to be the first reporter, and the report has to arrive through the HackerOne form rather than any other channel Automated scanner output with no demonstrated impact, plus the rate-limiting, banner disclosure and enumeration classes on the program's excluded-submission list Most-valued findings Injection through the Atlas Stack Language parser that reaches past the query engine, into server-side request forgery, file access or evaluation of something the expression language was never meant to touch. The expression surface is the richest untrusted input in the project, injection is the 35% top class, and this is the clearest route to the $5,000 Critical figure. A single crafted query, expression or Graphite line that takes an Atlas node down, which costs more than usual because the operator loses visibility exactly when an incident needs it Cross-tenant or cross-boundary information disclosure through the tag, graph or publish APIs that hands a caller telemetry describing infrastructure they have no business seeing Parsing and validation flaws in the JSON or Graphite wire codecs, reachable from any of the low-privilege hosts allowed to publish metrics Anything in atlas-chart 's rendering path that turns query output into code execution, a file read, or an outbound request from the rendering server Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Secondary tier means only Medium severity and above is considered, so a Low finding on Atlas pays nothing however clean the write-up is Netflix generally only issues a reward, in points or bounty, if it pursues a change based on your submission Severity is scored on impact to Netflix rather than on impact to a third-party organisation running Atlas in its own estate You must be the first reporter of the issue, and it has to come in through the HackerOne form rather than any other channel You must be 18 or over to be eligible for a reward Netflix commits to confirming a report within 7 days of submission, so expect the clock to start there rather than at triage Program stats 2,976 Reports resolved $352k Bounties paid 96% Response efficiency Disclosure File this one directly with Netflix through HackerOne. The program does not allow disclosure at all: you may not release information about a vulnerability found here to the public, and there is no window after which that lapses. sorona.xyz will not publish anything, and a sorona.xyz-routed report can be read as breaching the clause outright, so the payer's own channel is the safe one. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability