
LaunchDarkly
External Program
Submit bugs directly to this organization


External Program
Submit bugs directly to this organization
At LaunchDarkly, our vision is to create a world in which software releases are safe and unceremonious. LaunchDarkly gives product delivery teams the safeguards to move fast without breaking things through the use of feature flags.
As a platform that our users trust to handle their user and customer data, application security and data protection are crucially important to us. LaunchDarkly looks forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe.
LaunchDarkly will make a best effort to meet the following response targets for hackers participating in our program:
We’ll try to keep you informed about our progress throughout the process.
wearehackerone.com domain. Once you have confirmed your email address, accounts on this domain will automatically be activated on a plan that provides access to all features on the LaunchDarkly platform. These accounts must only be used for testing for the purposes of the LaunchDarkly Bug Bounty Program. If you would like an account for other purposes, you may sign up for another account with a different email address.
hackerone (for easy identification as a tester account). For example, you can create an account as [email protected]. Note that these accounts will have a regular trial that will expire.What it does: The main LaunchDarkly application and point of entry. LaunchDarkly customers use this interface to log into the application and manage feature flags, context types, segments, and so on. Admin level users may also manage their LaunchDarkly organization (i.e. users, roles, environments) from this interface.
How to test: Please create an account with your @wearehackerone.com email address in order to receive an account with full access to all features on the LaunchDarkly platform. Documentation for how to use LaunchDarkly may be found on our docs website.
What to look for: In addition to the usual web vulnerability concerns, we'd be particularly interested in any findings related to:
Additionally, we'd like to call special attention to the following application components that we recently released for general availability:
What it runs on: React/NodeJS
What it does: Provides the backend APIs for the LaunchDarkly application
How to test: Our external-facing API documentation may be found here: API docs
The /api/v2/ and /internal/ subroutes are customer-facing APIs and require either a valid ldso session cookie or an access token in the Authorization header for authentication. You may create an access token from the Account Settings page in the UI for use in API testing. If you prefer to use the session cookie, the ldso token may be retrieved from your own browser after logging into the UI.
Conversely, the /private/ APIs are not meant to allow authentication to any non-LaunchDarkly users and use a separate authentication mechanism. Any cases where these endpoints are improperly accessible are worthy of note.
What to look for: In additional to the usual API vulnerability concerns, we'd be particularly interested in any findings related to:
What it runs on: Golang
What they do: SDKs are integrated into customer applications to evaluate LaunchDarkly feature flags the application. LaunchDarkly provides a wide range of SDKs for various languages and platforms, documented here: SDK docs
How to test: We encourage researchers to integrate SDKs with custom applications and test the communication between the SDKs and LaunchDarkly's servers (see more details in the streamer/event recorder sections below). You'll need to generate an SDK key/client ID from the UI in order to initialize the SDK's connection with LaunchDarkly. We'd be interested in any general API vulnerability findings as well as any handler logic vulnerabilities that you may find.
Additionally, our SDKs are open source and are available on Github (e.g. React client SDK). We encourage researchers to dig into the open source code if interested. However, we will not be accepting the following types of findings:
-sdk)What it runs on: The SDKs cover a wide range of languages and platforms depending on the SDK, see the docs referenced above for details.
What this does: Streamer provides flag information for server and client SDKs for flag evaluation. SDKs maintain connectivity with distributed streamer nodes and receive flag updates as changes are made in the platform in real time, allowing end user clients to react instantaneously and update the application accordingly.
How to test: streamer.launchdarkly.com exposes a set of routes for retrieving flag data depending on whether the SDK is client or server-side (see the distinction here: client vs server SDKs).
What to look for: Generally, we're looking for ways that attackers could exploit our flag evaluation logic to improperly retrieve flag information meant for other users. Client-side SDKs are specifically meant to prevent attackers from accessing things such as flag evaluation rules due to the untrusted nature of client devices, so any improper handling/exposure of this data may be considered noteworthy.
What it runs on: Golang
What this does: Once flags are evaluated by the client/server SDKs, these SDKs will record and send events to events.launchdarkly.com for metrics collection. This allows customers to collect data about things such as which flags are being evaluated, how many times flags are evaluated, which contexts are being targeted, etc.
How to test: events.launchdarkly.com exposes a set of routes for handling and processing event data. No authentication is needed to access these endpoints, but the endpoint may expect certain metadata to be considered valid input.
What to look for: We'd be interested in ways that attackers may want to exploit our event recording mechanisms.
What it runs on: Golang
What this does: Static site hosting LaunchDarkly documentation (i.e. installation/user/admin guides, API references, etc.)
What to look for: The site is mostly static, but there are user input fields (e.g. search bar) that we'd want to ensure are not vulnerable to any XSS or other injection vulnerablities. The site also makes cross-origin requests to app.launchdarkly.com, so any potential CSRF vulnerabilities would be noteworthy.
What it runs on: React/NodeJS
What these do: LaunchDarkly provides a handful of third party integrations for use by customers. While these aren't considered in scope today, we are working on refining our testing methodologies for these integrations and plan on making these available for testing in our program in the future.
Our rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of LaunchDarkly.
Please note that the following issues are considered known risks and will not be eligible for bounties:
ldso cookie.-sdk)Launchdarkly credentials that have been leaked are only eligible if:
"bountyEligible": true value in the /api/v2/caller-identity response. This excludes testing accounts, and other accounts with no valuable data.Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep LaunchDarkly and our users safe!