Netflix Program Policy

Netflix’s goal is to deliver joy to our members around the world, and it is the security team's job to keep our members, partners, and employees secure. We have been engaging with the security community to achieve this goal through programs like responsible disclosure and private bug bounty for a number of years. Our bug bounty program aims to continue improving the security of our products and services while strengthening our relationship with the community.

Program Guidelines

---

We require that all researchers:

• Do not access customer or employee personal information, pre-release Netflix content, or Netflix confidential information. If you accidentally access any of these, please stop testing and submit the vulnerability.
• Stop testing and report the issue immediately if you gain access to any non-public application or non-public credentials.
• Do not degrade the Netflix user experience, disrupt production systems, or destroy data during security testing.
• Perform research only within the scope set out below.
• Use the HackerOne report submission form to report vulnerability information to us.
• Collect only the information necessary to demonstrate the vulnerability.
• Submit any necessary screenshots, screen captures, network requests, reproduction steps, or similar using the HackeOne submission form (do not use third-party file-sharing sites).
• When investigating a vulnerability, please only target your own account and do not attempt to access data from anyone else’s account.
• Securely delete Netflix information that may have been downloaded, cached, or otherwise stored on the systems used to perform the research.

If you fulfill these requirements, Netflix will:

• Work with you to understand and attempt to resolve the issue quickly (confirming the report within 7 days of submission)
• Pay you for your research for unique vulnerabilities that meet the guidelines listed below if you are the first to report the issue to us using the HackerOne portal.

To encourage responsible disclosure, Netflix will not bring a lawsuit against you or ask law enforcement to investigate you if we determine that your research and disclosure meet these requirements and guidelines. If you have questions about responsible disclosure of results for a submission, please reach out to us via the submission page.

Please collect all relevant information related to your research and provide sufficient details, including proof of concept, videos, and screenshots. Reach out to us through the submissions page, and feel free to include any questions in your report.

Reward Guidelines

---

Netflix wishes to incentivize broad, information-rich vulnerability submissions to our program, particularly for the Targets we have listed.

Please note that Netflix generally only issues a reward (points and/or bounty) if we pursue a change based on the researcher's submission, and we retain the sole discretion to reward (points and/or bounty) any such submission even if it relates to a target that isn’t listed below.

For certain vulnerabilities that may be present in different parts of a web application or view, Netflix may provide, at its discretion, an additional reward for those reports that detail multiple vectors for injections, XSS, or similar. This reward is in addition to the award ranges detailed below.

Primary Target

Primary targets make up the Netflix.com user experience.

Secondary Targets

Secondary targets are systems that have less impact on the primary Netflix experience, and so will be paid at a lower rate than primary targets (see “Secondary Reward Guidelines” below).

• Public Netflix web applications not related to the web browser www.netflix.com experience are secondary targets.
• In addition, valid vulnerabilities for these submissions will only be considered for risks of medium severity or higher.

Mobile Target

Netflix Mobile application for IOS and Android

Corporate Targets

For targets listed in the "Corporate Targets Overview" section, we only reward for the bugs that are critical or High based on the CVSS.

• We do accept submissions of overly exposed Google documents (as described in Corporate Targets above), which start at Low severity.
• Submissions must meet other applicable requirements (e.g. not an Excluded Submission Type).
• Medium and Low severity reports will be accepted but will not be eligible for a bounty.

These are the ranges of rewards we typically choose to provide:

Content Authorization Targets

High severity targets include methods of subverting content authorization or obtaining private keys. Medium targets include leaked private keys for content decryption. Submissions of hardware-backed private keys (i.e. from a TEE) & key exfiltration methods will have higher payouts than submissions of software-backed private keys & key exfiltration methods.

Scope & Target Overview

---

Primary Targets Overview

Primary targets make up the Netflix.com user experience. Valid vulnerabilities submitted against primary targets will result in higher payouts than secondary applications (see “Primary Target Reward Guidelines” below).

Mobile Targets Overview

Corporate Targets Overview (Netflix.com Google G Suite)

Insecure usage or misconfiguration of the G Suite instance associated with ONLY the netflix.com, netflixcontractors.com, and netflixanimation.com domains (NOT any subdomains such as subdomain.netflix.com or ANY OTHER domains such as netflixcs.com). Please note that this is limited to a vulnerability in Netflix’s usage and configuration of G Suite, and not G Suite itself.

Corporate target submissions must include information to help us understand root cause.

Publicly accessible Google Document or Drive Links:

• Individual Google documents that are publicly exposed can create risk, but we value root causes over reports of individual documents. -- Maximum payouts will come from reporting addressable root causes, not individual documents.
• Multiple documents that share a common root cause for their exposure will be paid out on the appropriate Target matrix based on the change necessary to address the root cause (payout amount may be higher or lower than simply based on the sensitivity & the number of exposed documents) Individual documents with no common root cause typically will be low severity under “Corporate Targets”. We will reward only where we choose to make a change.

For documents that contain particularly sensitive information (typically personal information or active credentials), we may choose a higher priority and associated payout range, based on impact. We expect this to be rare and on a case-by-case basis, and this determination is made by Netflix.

Please remember: our Guidelines require you to not access customer or employee personal information or Netflix confidential information. If you accidentally access any of these within exposed Google documents, please stop testing and submit the vulnerability.

Device & Content Authorization Targets Overview

Methods of subverting Netflix content authorization systems to achieve video playback on unauthorized devices are in scope. Examples include circumventing the content authorization systems, obtaining private keys used for authorization, etc.

• Only playback of full content is in scope.
• Supplemental content such as trailers, images etc. is not in scope.

Private keys used for video content decryption are in scope.

• Reports must contain private key material that enables the decryption of video streams at the time reported.
• Groups of keys discovered at the same time (e.g. leaked together) or using the same methods (shared vulnerability across multiple devices) will only qualify for a single reward.
• Submissions related to screenshots or screen recording are not in scope. Submissions must include actual private key material.

Reports must contain specific, clearly articulated and actionable details relating to how the keys were discovered or extracted to qualify for a reward.

Secondary Targets Overview

Secondary targets are systems that have less impact on the primary Netflix experience, and so will be paid at a lower rate than primary targets (see “Secondary Reward Guidelines” below). In addition, valid vulnerabilities for these submissions will only be considered for risks of medium severity or higher.

Public Netflix web applications not related to the web browser www.netflix.com experience are secondary targets.

Microsites Microsites are sites that Netflix typically publishes for promotion or in support of Netflix titles.

Third-party microsites: Not all microsites are hosted by Netflix. Some are hosted by vendors or partners.

• We cannot authorize you to test these sites as we do not own the computers that host them. It is critical that you confirm that Netflix is the owner of a particular microsite before testing.
• When in doubt, please reach out to the Netflix or HackerOne team(s) to confirm.

Open Source Targets Overview

Scoping Guidelines: Netflix publishes many projects as open source, but only some projects are in scope. Vulnerabilities will be rewarded as primary or secondary targets as specified below:

All other Netflix open source projects are not in scope for reward at this time. Please familiarize yourself with the README and SECURITY files (if present) in each project before testing. They will contain more details about the scope, security model, and a list of any excluded issues.

Open Source Reward Guidelines : Open source targets listed above will be paid out on the Primary or Secondary reward scales as specified above. Open Source projects which are not explicitly listed above are not eligible for reward at this time. The priority for these vulnerabilities will be assigned based on the impact to Netflix.

Non-Rewardable Targets

Our reward philosophy is that we reward (points and/or bounty) when we make a change based on sufficient impact to Netflix. However, to ensure that we are incentivizing impactful findings we have a few areas of submissions that are generally not eligible for payments. These will be rewarded with Kudos points only.

Specific areas include:

• Affiliates or entities such as recently acquired companies
• Content authorization vulnerabilities affecting only the in-browser player
• Low-impact, individually exposed Google Docs with no common root cause (see “Publicly accessible Google Document or Drive Links” in the “Corporate Targets” section)
• Netflix gaming targets
• Dependency Confusion via Package Takeover
  • We are aware of certain dependency confusion issues caused by package ownership in package managers and are working on a long-term scalable solution. While we are working on the solution, reports submitted sharing the same root cause will be marked as Duplicate of the original report which brought this issue to our attention. However, if you are able to demonstrate clear evidence of taken-over packages affecting or executing from Netflix infrastructure, please submit a report to us. Additionally, we would also incentivize reports that provide net new learnings and bypass our controls.

We may, at our sole discretion, choose to reward particularly impactful and informative submissions on otherwise non-reward-eligible targets. However maximum payouts will come from the explicitly listed targets.

Out-of-Scope (Please Read)

---

• Third-party websites or systems hosted by non-Netflix entities
• ir.netflix.com / ir.netflix.net
• Netflixinvestor.com
• Set-top-boxes, smart TVs, streaming sticks
• Dispatch OSS (https://github.com/Netflix/dispatch)
• ConsoleMe OSS (https://github.com/Netflix/consoleme)
• Weep OSS (https://github.com/Netflix/weep)
• ReadyPlayerMe and any assets associated with ReadyPlayerMe

In addition, findings that fall into the “Excluded Submission Types” listed below will also be flagged as out of scope.

If you have a concern about whether a potential submission is in-scope, please first validate that it is demonstrably owned by Netflix, and carefully read the "Out of Scope", "Excluded Submission Types", and the "Targets" sections. If it is still unclear but you believe it should still be considered, please submit via the program ONLY (instead of alternate channels like email), and include a few sentences describing your judgment regarding scope. Submissions that demonstrate thoughtful consideration for scope but that we ultimately do not act on will receive a "Not Applicable" status, rather than "Out Of Scope" with negative points.

Focus Areas

---

We encourage researchers to focus their efforts in the following areas:

• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• SQL Injection (SQLi)
• Server Side Request Forgery(SSRF)
• Authentication related issues
• Authorization related issues
• Data Exposure
• Redirection attacks
• Remote Code Execution
• Business Logic
• MSL Protocol (https://github.com/Netflix/msl)
• Particularly clever vulnerabilities or unique issues that do not fall into explicit categories
• Mobile-specific API vulnerabilities

Excluded Submission Types

---

Vulnerability reports which do not include careful manual validation - for example, reports based only on results from automated tools and scanners or which describe theoretical attack vectors without proof of exploitability - will be closed as Not Applicable.

Some of the vulnerability classes we consider to be excluded below:

• Cookie valid after logout
• Cookie valid after password change/reset
• Cookie expiration
• Cookie migration/sharing
• Forgot password autologin
• Autologin token reuse
• Static content over HTTP
• Free trials
• Home Location Mis-detection
• Borrower VPN bypass
• Same Site Scripting
• Physical Testing
• Social Engineering
  • For example, attempts to steal cookies, fake login pages to collect credentials
  • Phishing
• Denial of service attacks
• Resource Exhaustion attacks
• Mail Server Domain Misconfiguration (including email spoofing, missing DMARC, SPF/DKIM, etc.)
• Issues related to rate limiting
• Login or Forgot Password page brute force and account lockout not enforced
• Services listening on port 80
• Internal IP address disclosure
• Issues related to cross-domain policies for software such as flash, silverlight etc. without evidence of an exploitable vulnerability
• Username / Email Enumeration
  • via Login Page error message
  • via Forgot Password error message
  • via Registration
• Weak password policies
• Weak Captcha / Captcha bypass
• Vulnerabilities impacting only old/end-of-life browsers/plugins including:
  • Issues that have had a patch available from the vendor for at least 6 months
  • Issues on software that is no longer maintained (announced as unsupported/end-of-life or no patches issued in at least 6 months)
• Vulnerabilities primarily caused by browser/plugin defects and not representative of defects in the security of Netflix systems or software (e.g. UXSS)
• Reports relating to Symantec root certificates
• Vulnerability reports related to the reported version numbers of web servers, services, or frameworks
• Vulnerability reports relating to sites or network devices not owned by Netflix
• Vulnerability reports that require a large amount of user cooperation to perform, unlikely or unreasonable actions which would be more symptomatic of a social engineering or phishing attack and not an application vulnerability (e.g. disabling browser security features, sending the attacker critical information to complete the attack, guiding the user through a particular flow and requiring them to enter malicious code themselves, etc.)
• For Device & Content Authorization Targets: Vulnerabilities from already publicly broken protocols (e.g. HDCP v1.4)

Disclosure Stance

---

This program or engagement ==does not== allow disclosure. You may ==not== release information about vulnerabilities found in this program or engagement to the public.

#Data Deletion Any data cached or stored during the testing activities must be immediately deleted after report submission. Additionally, any data entered or stored in third-party applications or services as part of the testing process must also be completely deleted. Researchers are responsible for confirming the deletion of all such data and may be required to provide evidence of such deletion.

Additional Terms

Your testing must comply with applicable laws. This program is not an offer of employment. Whether to pay a reward and in what amount is at Netflix’s discretion. You are responsible for any taxes associated with a reward you receive. We may modify or cancel this program at any time.