Netflix Spectator

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Secondary Target, not the $25,000 Primary tier) │ $5,000 │ $6,000 High │ $2,000 │ $2,500 Medium │ $600 │ $750 Low (below the Secondary tier floor, not rewarded) │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Injection 35 % Denial of service 30 % Parsing/validation 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Spectator is the client-side half of the Netflix telemetry stack, compiled into essentially every JVM service Netflix runs, with Go, Python and C++ ports covering the non-JVM fleet. Externally it travels with the Netflix OSS ecosystem and, more importantly, it is a transitive dependency of a range of Netflix-origin libraries that outlived their parent stack. Its security position is unusual and undersold: an instrumentation library is linked into the address space of the application it measures, so a memory-safety or deserialisation flaw in Spectator is code execution inside every instrumented service rather than inside a separate observability tier, and spectatord , the sidecar daemon, listens on a local socket and accepts unauthenticated metric lines from any process on the host. Deployment breadth is materially smaller than Atlas's, which is the honest caveat on this entry, as is the fact that Spectator is named in Netflix's Open Source Targets Overview table rather than carrying a structured scope row of its own. Netflix pays it on the Secondary Target scale: $600 at Medium, $2,000 at High and $5,000 at Critical. sorona.xyz adds 1.25x on top of whatever Netflix awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~2 hours First response 7 days (Netflix's published confirmation commitment) Triage ~7 days Bounty In scope A live scope row named Open Source - Spectator carries github.com/Netflix/spectator at a maximum severity of critical and marks it a Secondary Target, and the policy's Open Source Targets Overview table names the same repository URL at the same tier The instrumentation library itself: the registry, the meter implementations covering counters, timers, gauges and distribution summaries, and the tag and dimension model every measurement passes through The spectator-reg-* registry backends, which are where third-party code plugs into the library The publishing pipeline that ships measurements to an Atlas backend, covering the HTTP client, the payload serialiser and the batching behind them spectatord , the sidecar and UDP line-protocol writer, which takes metric lines from any co-located process and is the one unauthenticated surface in the project Everything the library does inside the address space of the instrumented application, since that is where its code actually runs The sibling ports spectator-py , spectator-go and spectator-cpp sit in their own repositories and are not named individually, so say which one you tested and expect the JVM repository to be the safest ground Out of scope Every other Netflix open source project apart from Zuul and Atlas: the policy states that all other Netflix open source projects are not in scope for reward at this time Findings below Medium severity, which the Secondary tier floor rules out entirely Dependency-confusion package takeover, which the policy names as a known root cause that will be closed as a duplicate Third-party systems not hosted by Netflix, including somebody else's service that happens to link Spectator Reward is conditional on Netflix pursuing a change based on the submission, and severity is scored on impact to Netflix rather than on impact to an outside adopter Duplicates and reports filed outside the HackerOne form: first reporter only, through the program's own channel Automated scanner output with no demonstrated impact, along with the rate-limiting, banner and enumeration classes on the program's excluded-submission list Most-valued findings Injection or deserialisation in the measurement path that reaches code execution inside the instrumented application, the 35% top class here and the finding that carries the $5,000 Critical figure because it lands in the host process rather than in a metrics tier A crafted metric line or tag that takes down spectatord or the registry, which any unprivileged process on the same host can send and which silently blinds the operator when it works Parsing and validation flaws in the line protocol or the payload serialiser, where a malformed name, tag or value escapes the encoding it was supposed to stay inside Sensitive data leaking out through the publishing pipeline: credentials, tokens or request contents captured into tag values and shipped to a backend that was never meant to hold them Any of the above shown against the JVM library the scope row points at rather than only against a sibling port, since that is the repository the reward tier is attached to Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Secondary tier means Low severity is not considered at all, so the finding has to land at Medium or above to be worth anything Netflix generally only issues a reward, in points or bounty, if it pursues a change based on your submission Severity is scored on impact to Netflix rather than on impact to an outside organisation that has embedded Spectator in its own services Spectator has no structured scope row of its own and rests on being named in the Open Source Targets Overview table, so triage discretion is wider here than it is for Atlas: make the impact argument explicit Dependency-confusion package takeover is closed as a duplicate by policy, since Netflix already tracks it as a known root cause You must be the first reporter, must file through the HackerOne form, and must be 18 or over Program stats 2,976 Reports resolved $352k Bounties paid 96% Response efficiency Disclosure File this one directly with Netflix through HackerOne. The program does not allow disclosure at all: you may not release information about a vulnerability found here to the public, with no window after which that lapses. sorona.xyz will not publish anything, and a sorona.xyz-routed report can be read as breaching the clause outright, so the payer's own channel is the safe one. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability