Neon
Bounty Range
$300 - $5,000
external program
Neon
Neon looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Open Scope — Rewards reports for all owned assets based on impact, even if not listed in scope.
Fast Payment — Ensures payment within 1 month of receiving a vulnerability report.
Gold Standard Safe Harbor — Adheres to Gold Standard Safe Harbor.
Platform Standards — Fully compliant with Platform Standards.
Top Response Efficiency — This program's response efficiency is above 90%.
Managed by HackerOne — Collaboration Enabled. Includes Retesting.
Neon is an open-source database company dedicated to delivering a serverless PostgreSQL platform optimized for cloud deployment. Our architecture separates storage and compute, enabling features like autoscaling, instant branching, and bottomless storage. Committed to continuous development, we regularly release new features and enhancements, providing ongoing opportunities for security testing. We invite researchers to collaborate with us in identifying and addressing potential vulnerabilities, ensuring our platform remains robust and secure.
Time to resolution varies by complexity and severity.
Our rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Neon.
| Severity | Average Bounty | Percentage of Submissions |
|---|---|---|
| Low | $300 | 33.33% |
| Medium | $750 | 12.12% |
| High | $2,017 | 39.39% |
| Critical | $5,050 | 15.15% |
To qualify for rewards, the following criteria must be met:
We welcome reports of:
NOTE Neon has been acquired by Databricks and we maintain two distinct bug bounty programs. It is important to note that Neon and Lakebase share a common codebase; consequently, we can only accept a specific vulnerability report once across both platforms. We strongly advise that prior to submitting a vulnerability report concerning Neon, you verify its applicability to Lakebase and submit the report through the Databricks bounty program, as the associated bounties are typically more substantial.
Core Ineligible Findings are out of scope.
To keep things efficient and reduce unnecessary noise for the Neon team, please exclude the following forms from your tests:
Test credentials, dummy data, and placeholder values (e.g., username:password, dummy certs) clearly marked for testing are out of scope. Reports must demonstrate impact on a production system to be considered valid.
Subdomain takeovers that lack demonstrable impact are out of scope.
Sending vulnerability reports using automated tools without validation.
We're aware of the following vulnerabilities and do not award these reports unless you can combine multiple vulnerabilities to have a bigger impact:
In addition to the "HackerOne's Core Ineligible Findings" list, the following are considered out of scope unless a proof-of-concept (PoC) demonstrates exploitability:
Note: We cannot reward or work with individuals on U.S. sanction lists or residing in sanctioned countries. This includes, but is not limited to, residents of Iran, North Korea, Syria, Crimea region of Ukraine. Severity level is at the sole discretion of the Neon security team.
This program has committed to awarding submissions for discovered leaked credentials.
To support impactful testing without affecting real users or production data, we encourage researchers to use our staging environment for security testing, which is a replica of production, especially when testing paid features.
You may upgrade accounts using test credit cards on staging. The invite code and test card details are listed in the program scope for your convenience.
The triage team also uses staging to verify vulnerabilities that involve paid account actions or subscription logic.
This setup ensures that tests are safe, reproducible, and isolated from live user data. If you have questions about staging environment usage, feel free to message us through HackerOne.
Please adhere to the following rules to ensure compliance with the program:
Important: Use your HackerOne email alias (e.g., [email protected]) when creating accounts, so we can recognize legitimate testing accounts. If you run security scans against Neon's systems without using your @wearehackerone.com email address, your email may be blocked. Please ensure you use your HackerOne email when testing.
Neon reserves the right to change program terms at any time.
For vulnerabilities involving information disclosure, avoid capturing or retaining personally identifiable information (PII). If you inadvertently access or alter any PII, stop testing immediately and report the issue along with reproduction steps to help our team assess the impact.
When possible, please employ methods that confirm elevated access without exposing PII. Examples include:
Provide detailed, clear reporting with screenshots, proof-of-concept code, and steps to reproduce. Rewards reflect the impact, severity, and creativity of the vulnerability discovered. Bug bounty rewards are solely at Neon's discretion, based on the severity and creativity of the bug.