- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 10
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
Sorona does not publish a reward table for this program.
- Lowest reward
-
$500
Minimum award, where Meta pays a bounty at all │ $500 │ $625
- Pays cash
-
Yes
Meta pays cash for a report with a published minimum of $500, determines severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance.
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 8 excluded.
Web 1
- https://velox-lib.io
Products and areas 9
- Memory management: the pool hierarchy, the arbitrator, the allocators, and the accounting meant to stop one query starving another
- Meta's scope table names https://github.com/facebookincubator/ as an eligible code-repo prefix, so the whole of facebookincubator/velox is in scope, every component and every release. Meta determines severity itself and publishes no ceiling for an open-source target.
- Serialization and shuffle: the Presto, CompactRow and UnsafeRow serialisers together with the exchange client that pulls pages from other workers over the network
- The dwio connector stack that reads and writes Parquet, ORC and DWRF, from footer and metadata parsing down to the column decoders and compression codecs
- The execution operators: hash and merge joins, aggregations, window functions, sorting, and the spill-to-disk paths behind them
- The expression evaluation engine, covering compilation, constant folding, peeling and the vectorised function call path
- The Python bindings, the runner binaries and the build tooling in the repository, all covered by the same prefix
- The SQL function libraries for both the Presto and the Spark dialect, where string, date, JSON, URL and regular-expression functions touch user values directly
- The vector library and type system: the flat, dictionary, constant and lazy layouts, decoding between them, and the buffer arithmetic every operator is built on
Out of scope (8)
- Awards blocked by sanctions screening, since Meta confirms every bounty is permitted under US trade sanctions and economic restrictions
- Defects in Presto, Spark or Gluten themselves rather than in the Velox execution layer they embed
- Extremely low-risk issues, which Meta states may not qualify for a bounty at all
- Findings with no demonstrated impact on Meta users or systems, and duplicates, since only the first reporter is paid
- Performance regressions and out-of-memory conditions under legitimate load on an under-provisioned worker
- Repositories outside the two eligible code-repo prefixes; the same scope row names https://github.com/facebookarchive/ as ineligible
- Third-party libraries Velox builds against, which belong to their own maintainers
- Wrong query results with no security consequence. A correctness bug in a SQL function is a bug report rather than a vulnerability.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz first.
-
File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report
-
Duplicates pay only the first reporter
-
Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions
Not accepted
-
Wrong query results with no security consequence. A correctness bug in a SQL function is a bug report rather than a vulnerability.
-
Performance regressions and out-of-memory conditions under legitimate load on an under-provisioned worker
-
Extremely low-risk issues, which Meta states may not qualify for a bounty at all
-
Findings with no demonstrated impact on Meta users or systems, and duplicates, since only the first reporter is paid
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 45 % Denial of service 25 % Parsing/validation 20 % Info disclosure 5 % Latest advisories Loading the feed Overview Velox is a C++ vectorised query execution engine built to be embedded by other data systems rather than run on its own. It is the execution layer under Presto's native worker and under Apache Gluten, which is how Spark clusters end up running it. Its attack surface is exactly the one that matters most in a query engine: it parses and evaluates expressions over untrusted, frequently user-supplied data, in C++, at very high volume, on workers that are usually shared between tenants. There are no CVEs against it to date, which for a codebase of that shape reads as under-examined rather than hardened. Velox is in scope through the second of Meta's two eligible GitHub org prefixes: facebookincubator/ , not facebook/ . Meta pays cash for a report with a published minimum of $500, determines severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta's scope table names https://github.com/facebookincubator/ as an eligible code-repo prefix, so the whole of facebookincubator/velox is in scope, every component and every release. Meta determines severity itself and publishes no ceiling for an open-source target. The vector library and type system: the flat, dictionary, constant and lazy layouts, decoding between them, and the buffer arithmetic every operator is built on The expression evaluation engine, covering compilation, constant folding, peeling and the vectorised function call path The SQL function libraries for both the Presto and the Spark dialect, where string, date, JSON, URL and regular-expression functions touch user values directly The execution operators: hash and merge joins, aggregations, window functions, sorting, and the spill-to-disk paths behind them The dwio connector stack that reads and writes Parquet, ORC and DWRF, from footer and metadata parsing down to the column decoders and compression codecs Serialization and shuffle: the Presto, CompactRow and UnsafeRow serialisers together with the exchange client that pulls pages from other workers over the network Memory management: the pool hierarchy, the arbitrator, the allocators, and the accounting meant to stop one query starving another The Python bindings, the runner binaries and the build tooling in the repository, all covered by the same prefix Out of scope Repositories outside the two eligible code-repo prefixes; the same scope row names https://github.com/facebookarchive/ as ineligible Defects in Presto, Spark or Gluten themselves rather than in the Velox execution layer they embed Third-party libraries Velox builds against, which belong to their own maintainers Wrong query results with no security consequence. A correctness bug in a SQL function is a bug report rather than a vulnerability. Performance regressions and out-of-memory conditions under legitimate load on an under-provisioned worker Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, and duplicates, since only the first reporter is paid Awards blocked by sanctions screening, since Meta confirms every bounty is permitted under US trade sanctions and economic restrictions Most-valued findings Memory corruption reachable from a query expression an ordinary analyst could submit. Memory safety is 45% of the expected distribution here, and corrupting memory on a shared query worker means running code as that worker. A malformed Parquet, ORC or DWRF file that corrupts memory in the reader, since data files routinely arrive from parties the cluster has no reason to trust Cross-query or cross-tenant data exposure, where one query reads buffers another query left behind on the same worker Vector type or encoding confusion that turns a dictionary or lazy vector into an out-of-bounds read Corruption driven by a crafted exchange page arriving from another worker, untrusted input on a path most operators assume is internal A cheap query that exhausts worker memory or CPU across the cluster, the denial-of-service shape a multi-tenant engine cannot absorb Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so an expression bug reachable by an ordinary query on a shared worker is worth far more than one needing operator privileges Velox is eligible under https://github.com/facebookincubator/ , the second prefix on the scope table's Open source row: checking only facebook/ will tell you the wrong answer Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability