Watchman

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Memory safety 30 % Info disclosure 20 % Denial of service 10 % Latest advisories Loading the feed Overview Watchman is a local file-watching service that runs as a persistent daemon on developer machines and CI workers, driven by Jest, by Metro (the React Native bundler), by Buck and by Sapling and Mercurial. Its security-relevant shape is unusual for this program and worth stating plainly: it is a long-lived local daemon with a Unix-socket control channel that reads a project-supplied .watchmanconfig , so the interesting findings are local privilege and trust-boundary issues on developer and build machines rather than remote ones, which is why access control is the largest slice of the expected bug distribution here. That is not a discount. A build-machine compromise is a supply-chain foothold, and the machines Watchman runs on hold source code, signing keys and deploy credentials, which is why a project with almost no CVE history deserves more attention than that history suggests. Meta pays cash for a report with a published minimum of $500, sets severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta's scope table names https://github.com/facebook/ as an eligible code-repo prefix, so the whole of facebook/watchman is in scope, every component and every release. Meta determines severity itself and publishes no ceiling for an open-source target. The daemon: startup and auto-spawn, the Unix domain socket and Windows named pipe it listens on, socket ownership and permissions, and the identity checks between a client and the server it reaches The BSER binary protocol and the JSON protocol, encoding and decoding alike, together with the Python and Rust client libraries and the CLI shipped in the same repository Configuration handling, above all the project-supplied .watchmanconfig that arrives with any repository a developer clones Triggers and subscriptions, which let a watched project cause the daemon to spawn commands on the developer's behalf The query engine: expression terms, glob and path matching, and the since and clock-spec machinery clients rely on for correctness The watcher backends for each platform, meaning inotify, FSEvents, kqueue, the Windows portability layer and the EdenFS integration State on disk: the state directory, log files, cookie files, trigger persistence and saved state, with their names, permissions and symlink behaviour Out of scope Repositories outside the two eligible code-repo prefixes; the same scope row names https://github.com/facebookarchive/ as ineligible Defects in the tools that drive Watchman, meaning Jest, Metro, Buck or Sapling, rather than in the daemon itself Attacks that require root, or an account that already holds the privilege being claimed, which sit inside the trust boundary rather than across it Resource consumption on a machine watching a very large tree, absent a crafted input that makes the cost disproportionate Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, and duplicates, since only the first reporter is paid Awards blocked by sanctions screening, since Meta confirms every bounty is permitted under US trade sanctions and economic restrictions Most-valued findings Local privilege escalation through the daemon's socket or state directory. Access control is 35% of the expected distribution here, and the daemon runs continuously on machines holding source code and signing credentials. Command execution triggered simply by cloning a hostile repository, since .watchmanconfig and trigger definitions arrive with the checkout and no developer reads them first Cross-user access on a shared CI worker, where one job can reach or influence another job's daemon Memory corruption in the BSER decoder driven by a crafted client request or a crafted state file Any of the above framed as a supply-chain foothold on build infrastructure, the impact that turns a local-only bug into a serious one here Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so a local finding is worth most when you can show it as a foothold on a build or developer machine rather than as a daemon crash Only repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible; facebook/watchman qualifies under the first Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability