New Relic Public Bug Bounty Program

Description

New Relic is committed to the security of our customers and their data. We believe that engaging with security researchers through our bug bounty program is an important means of achieving our security goals. If you believe you have found a security vulnerability in one of our products or websites, we welcome and greatly appreciate you reporting it to New Relic. Please ensure that it is in scope for this program, paying close attention to the vulnerabilities and targets explicitly listed below as out of scope. The New Relic bug bounty program is primarily focussed on vulnerabilities in our platform and distributed products. We accept reports of website vulnerabilities, subject to the scope outlined below, but they are subject to lower bounty awards. If you are a customer and have a password or account issue, please contact New Relic support . Getting started To get the most out of our program, you should familiarize yourself with New Relic and our products. You can sign up for a free trial , install our agents within your servers or applications, and read over our extensive documentation . Credentials Accounts on all publicly facing targets can be self-provisioned. Please sign up for an account using your @bugcrowdninja.com email address, any secondary accounts can be created using a modifier like: [email protected]. For more info regarding @bugcrowdninja email addresses, see here . Free accounts are the only account type in scope for this program currently. When registering an account, in the Name field, add “BugBounty-” to the beginning of your name, and use your BugCrowd username (e.g., BugBounty-gr8hacks). This will ensure that your account will not be marked as malicious by internal teams and you can test without issue. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, an explanation will be provided to the researcher. Rewards are awarded based on the merit of reported vulnerabilities, in New Relic’s sole discretion. Only the first verified report will be eligible for a reward. New Relic does not award Informational / P5 issues.

Targets

Bug Bounty Program Policy What we expect of researchers: To encourage coordinated disclosure, New Relic does not intend to initiate any legal action or law enforcement investigation against security researchers, unless it is required by law, if researchers adhere to the following guidelines: Include all impacted account numbers on one.newrelic.com in your report Do not access or modify customer data or other customer accounts; your research should be limited only to the account or data that belongs to you. To test, please sign up for a free trial Carefully read the program details before researching your issue and only perform research that conforms to the rules and scope of this policy Comply with all applicable laws and regulations around security testing activities and respect New Relic’s intellectual property rights Report full details of a discovered security issue to New Relic without making any information or details of the vulnerability public. Reports that refer to a pull request in our open source projects will not be rewarded. Allow New Relic reasonable time to resolve the issue. Some reports may take time to properly investigate and remediate. Provide as much detail as possible in your report in order to help New Relic’s security team and engineers reproduce the issue. If the report is not detailed enough to reproduce the issue, it will not be eligible for a reward. Make all reasonable attempts in good faith to avoid destroying, stealing, modifying, damaging, violating or otherwise jeopardizing the confidentiality of any New Relic customer or New Relic data. This includes disrupting or degrading New Relic’s products and service to its customers. Reporting issues Please include detailed steps for replicating the finding; including screenshots, links you clicked on, pages visited, etc., we prefer detailed reproduction steps over video demos. Describe the versions of all relevant components of the attack (eg browser, OS, mobile app version). Describe a concrete attack scenario. How will the problem impact New Relic customers? Please group related issues into the same report rather than multiple nearly-identical reports. For example, an authorization bypass might affect a handful of endpoints. We ask that researchers who identify the same or similar types of issues in multiple locations throughout an application combine those findings into a single submission whose description includes the locations where the issues were identified. What you can expect from us: *Unless the circumstances warrant otherwise, New Relic will strive for open communication, which includes aiming to provide an initial response to the researcher within 30 days. Public disclosures should be mutually agreed upon between New Relic and the researcher. The nature and circumstances surrounding a vulnerability may consider more careful and private investigation and remediation. New Relic will pay qualifying bounty amounts below by category. We aim to be fair, and all reward amounts are at our discretion. When duplicate reported vulnerabilities occur, we award the first report that we can completely and validly reproduce with the information provided. Multiple reports related to the same root cause will be awarded one bounty; New Relic considers a vulnerability within a software module that runs on multiple subdomains to have the same root cause. All vulnerabilities are rated according to New Relic 's internal vulnerability remediation process at its sole discretion. This process takes into account the impact to New Relic and our customers if it was exploited. Example Issues by Severity Below are some examples of vulnerabilities we're interested in seeing, and common severity ratings for those issues. Note that the final severity rating may be higher or lower than what is listed here. Critical severity bugs: Remote code execution (RCE) on New Relic backend services RCE on hosts via installed New Relic agents RCE on host via Synthetics container escape High severity bugs: Authentication bypass Access to sensitive data (e.g. Insights, Synthetics) from other New Relic accounts SQL injection with demonstrated security impact Stored cross-site scripting (XSS) on that is likely to affect other users (except for frame-rpm.newrelic.com) Flaws that could be used to exploit 3rd-party integration services Unauthorized configuration changes to installed New Relic agents Takeover of newrelic.com subdomains with arbitrary HTML and JavaScript Medium severity bugs: Cross-site scripting (XSS) (except for frame-rpm.newrelic.com) Cross-site request forgery (CSRF/XSRF) of a non-idempotent (AKA state-changing) request Clickjacking on authenticated pages with sensitive state changes Default New Relic agents collecting and sending undocumented confidential data to New Relic Confidential data disclosure with security impact Testing is only authorized on the targets listed as in scope. Any domain/property of New Relic not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to New Relic, you can report it to Bugcrowd Portal . However, be aware that such reports will be ineligible for rewards or points-based compensation. Accepted Risks: Cache purge requests are permitted without authentication. This has no significant impact on system throughput. User specified email contents (including invitations) are freeform text and may contain URLs and HTML tags. This is intensional and by design. Our CORS policy is intentionally permissive to all subdomains of NewRelic.com and some other New Relic controlled domains. APIs can be called by Basic users including APIs where the UI is not presented to a Basic user. This is intentional. Basic users are shown a reduced UI but are welcome to use the platform via APIs. Introspection is allowed on the object model within NR1. The information is considered public. The default user (i.e. the user account used when no user has logged in) on the support forums can access various Salesforce objects. These objects contain only data that we consider to be public and access is read only. A logged-on user can access forum contents and a limited subset of information about other users via direct or indirect object references in GET and POST requests, typically using the collaboration object. This information is intentionally public and has been carefully reviewed. This is expected and by design behavior. IDP SSO intentionally places the determination of user validity into the control of an external SSO provider. It is the responsibility of the SSO provider to be an honest broker. Issues related to malicious use of IDP will not be accepted. Unregistered domains or social media accounts linked from New Relic landing pages Leakage of API keys from customer locations such as source code repositories or inactive/test accounts created by employees (i.e. API keys where there is no security impact from their disclosure) will be accepted, triaged, and resolved, but no bounty will be paid Information disclosures via /status or /metrics URLs without security impact EXIF Geolocation Data Not Stripped From Uploaded Images Username / Account enumeration via email addresses Username and name disclosures on https://support.newrelic.com will be marked as Out of Scope, as this information is publicly available and does not constitute sensitive data. However, disclosures of email addresses or other PII remain in scope. Exclusions: The following are expressly prohibited (and void reward eligibility): Physical attacks against New Relic employees, offices, and data centers. Social engineering of New Relic employees, contractors, vendors, or service providers (e.g. phishing, vishing, smishing, et al.). Automated security testing against New Relic applications or servers; scanning tools such as nmap or Burp Suite are acceptable for research, but we do not want reports generated by automated tools. Actions or testing that have the ability to take down the services, features, or functionality (e.g., DDoS) or impact the reliability of the services Pursuing vulnerabilities that send unsolicited bulk messages (spam). Pursuing vulnerabilities through the compromise of a New Relic customer or employee account (e.g. do not attempt to gain access to another user’s account or data). Knowingly posting, transmitting, uploading, linking to, or sending any malware to New Relic or its employees. Mass account creation for testing against New Relic applications and services. "Brute force" testing to determine whether rate limiting is in place for particular APIs or pieces of functionality or when mass creating pull requests against github.com repositories to determine CI/CD platform exploitability. Researchers should review individual repository files and builds to determine if they are a potential vulnerable target. Disclosing information to the public without the express permission of New Relic or before the issue has been resolved Creating new or multiple BugCrowd accounts to re-submit issues. Submitting reports for pull requests made by other users or submitting pull requests prior to submitting a BugCrowd report. AI chatbot integrations on newrelic.com are explicitly out of scope Out of Scope: Out of scope issues (not eligible for a reward). Note, this is not an exhaustive list and New Relic reserves the right to modify the severity of a finding based on internal context : Information disclosure without significant security impact CSRF/XSRF without demonstrating security impact; CSRF on login/logout pages Self-XSS and any vulnerability exploitable only through Self-XSS XSS issues concerning frame-rpm.newrelic.com Denial-of-service (DoS) and Distributed denial-of-service (DDoS) vulnerabilities against NR1, Clients, or Agents; lack of rate limiting/load-testing issues on APIs Vulnerabilities affecting end of life, unmaintained, or unsupported services– such as browsers, platforms, or agents Vulnerabilities requiring unlikely user interaction or require physical access to a user's machine/device Vulnerabilities in Agents from insecure relative paths on a host system Vulnerabilities requiring a Man-in-the-Middle, with no other possible exploitation AI chatbot integrations on newrelic.com are explicitly out of scope Synthetics Arbitrary Code Execution without demonstrating security impact Sandbox Escape without Container/Isolation Escape Private Locations - Vulnerabilities from Out-of-Date/Vulnerable Packages AI Prompt Injection that allows arbitrary prompts to be answered without demonstrated security impact Any vulnerability that involves prompt disclosure Self-inflicted prompt injection vulnerabilities such as XSS without demonstrated security impact Access Control Issues concerning the original user model (including access control bypasses for Restricted users) Access control bypasses for Basic users in the New Relic One user model for features limited to Full users; Basic users can become Full users at any time, therefore this isn't considered a security barrier Third-party Vulnerabilities in 3rd-party scripts used on New Relic websites Vulnerabilities in Customer feedback submission forms (feedback.service.newrelic.com) Remote code execution on a 3rd party CI/CD platform without the exposure of New Relic secrets or additional impact on New Relic data or infrastructure. Thank you for helping keep New Relic and our users secure!`

Tier One Targets (in scope)

Target Information: New Relic One : New Relic One is the industry’s first entity-centric observability platform. This platform allows our customers to view across accounts and products. Assets in both the North American and European region are in scope for our bug bounty program, except where otherwise noted. New Relic allows sign-in via direct login, SSO, and social logins. When logging in via social login, it is expected that the session will persist as long as the third party service still has a valid session. All services can be found at: https://one.newrelic.com/all-capabilities New Relic software distributed via GitHub can be found at: https://github.com/newrelic New Relic agents, both infrastructure and language, are used to send information (running processes, memory usage, etc.) from the system where they are installed to be viewed within the New Relic web application. We may provide rewards for security issues found within our agents that could reduce the security of the application the agent is integrated with. Rewards are based on the default configuration settings, but agents that show problems due to a configuration change may be eligible for a reward. Synthetics minions are sandboxed virtual machines that run monitors (scripts) to gather information about your websites, critical business transactions, and API endpoints. Minions can run in our data center or privately within your own infrastructure. We recommend familiarizing yourself with the product by reading our documentation. Note that out-of-date packages running on these minions are not in scope for this program. Minions are intended to be updated from within the VM or with future releases. The New Relic agents are designed to collect data and send it back for display within the New Relic products . Traffic between the agents and New Relic backend services may be inspected and reports concerning issues with how the agent connects and transports information are acceptable. New Relic Mobile Applications: The New Relic Android app and New Relic iOS App lets you access your data wherever you are. Receive alerts, view, query, and share dashboards, and more all from your mobile device. ⚠️ Notice [Effective August 17, 2026 at 07:12 UTC] : All Agents listed below are Temporarily Out of Scope. Reports submitted after this notice was posted will not be eligible for rewards. We will update this section when they return to scope. Tier One Agents (with documentation references): Infrastructure agents - The New Relic Infrastructure agents are used to send information (running processes, memory usage, etc.) from Windows and Linux servers to be viewed within the New Relic One platform. Browser agent - The New Relic Browser agent is deployed as a JavaScript snippet by way of a supported APM agent or web application . It is designed to collect data about the running application and send it back for display within the New Relic One platform Android agent - The New Relic Android agent is installed via Gradle within a supported Android application . It is designed to collect data about the running application and send it back for display within New Relic Mobile . iOS agent - The New Relic iOS agent is installed as a framework or via CocoaPods within a supported iOS application . It is designed to collect data about the running application and send it back for display within New Relic Mobile . Go agent - The New Relic Go agent is installed within a supported Go application . It is designed to collect data about the running application and send it back for display within New Relic APM . Node.js agent - The New Relic Node.js agent can by installed via npm within a supported Node.js application . It is designed to collect data about the running application and send it back for display within the New Relic One platform. Ruby agent - The New Relic Ruby agent is installed as a Ruby gem within a supported Ruby application . It is designed to collect data about the running application and send it back for display within the New Relic One platform. Unity agent - The New Relic Unity agent is installed within a Unity application on iOS or Android. It is designed to collect data about the running application and send it back for display within the New Relic One platform. PHP agent - The New Relic PHP agent can be installed within a supported PHP application . It is designed to collect data about the running application and send it back for display within the New Relic One platform.

Tier Two Targets (in scope)

Target Information: New Relic website: All assets under *.newrelic.com are in scope for our bug bounty program, except where otherwise noted. Services hosted by third party providers are out of scope and should not be tested against. New Relic blog: Our blog is hosted externally by Pantheon. Issues within this application or regarding our content should be reported here. No security testing should be done against the platform itself. Any security issues found within the platform should be reported directly to Pantheon. Unregistered domains or social media accounts linked from this domain are not in scope for bounty. New Relic Support websites: Includes support.newrelic.com, forum.newrelic.com, knowledge. newrelic.com These sites are built on the Salesforce Experience Cloud platform. Issues unique to our installation are in scope for bounties. Issues with Salesforce itself are not in scope and should not be researched on our instance. Spam, brute forcing, and social engineering are strictly forbidden. All care should be made to avoid generating new posts or otherwise affecting the experience of other users on the forum. Note: No XSS payloads should be attempted unless there is reason to believe our instance is uniquely vulnerable due to our modifications. If an issue is discovered, the payload should immediately be deleted and reported to prevent other users from encountering it. New Relic University: Our training portal is hosted externally by Skilljar. Issues within this application or regarding our content should be reported here. No security testing should be done against the platform itself. Any security issues found within the platform should be reported to the Skilljar security team.