Policy and restrictions
Disclosure requires written consent. Spam, social engineering and physical intrusion are prohibited. Generic rules exclude automated scanning/reporting, while human-validated AI assistance is permitted.
Eligibility and submission status
Human-validated reproducible reports with concrete impact are required; sanctions restrictions apply. Platform participation requires adulthood or guardian-approved age 16, and legal/employer eligibility.
Logged-out policy and login invitation do not independently verify current acceptance.
Advertised rewards
No monetary bounties. Valid original findings may receive public recognition and associated CVEs where applicable.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
https://github.com/grafana/grafana | Source code | Tier 1 |
Non-Core Grafana Plugins | Other | Tier 1 |
https://github.com/grafana/alloy | Source code | Tier 1 |
https://github.com/grafana/faro-web-sdk | Source code | Tier 1 |
https://github.com/grafana/k6 | Source code | Tier 1 |
https://github.com/grafana/beyla | Source code | Tier 1 |
https://github.com/grafana/pyroscope | Source code | Tier 1 |
https://github.com/grafana/loki | Source code | Tier 1 |
https://github.com/grafana/mimir | Source code | Tier 1 |
https://github.com/grafana/tempo | Source code | Tier 1 |
https://github.com/grafana/* | Wildcard | Tier 2 |
| Asset | Type | Group / eligibility |
|---|---|---|
| No rows captured. This does not establish that the program has no assets or restrictions. | ||
Review limitations
- No dedicated announcement archive or policy revision date was established.
- Logged-out text review; authenticated eligibility and incorporated documents were not exhaustively checked.
- High-level summaries omit inventories and testing instructions. Live terms prevail; this record grants no authorization.
Sources and provenance
- Grafana Labs Vulnerability Disclosure Program policy Grafana Labs / Intigriti · reviewed 2026-10-03
- Intigriti Researcher Terms & Conditions Intigriti · reviewed 2026-10-03
- Published Intigriti asset table Grafana Labs · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.