Grafana Vulnerability Disclosure

generated: '2026-06-20'
method: searched
probe: true
source: https://grafana.com/legal/report-a-security-issue/
policy:
- https://grafana.com/legal/report-a-security-issue/
- https://app.intigriti.com/programs/grafanalabs/grafanalabsvdp/detail
contact:
- security@grafana.com
bug_bounty:
  platform: Intigriti
  vdp_url: https://app.intigriti.com/programs/grafanalabs/grafanalabsvdp/detail
  bbp_url: https://app.intigriti.com/company/programs/grafanalabs/grafanaossbbp/detail
  recognition: Grafana Labs Security Hall of Fame
  bounty: >-
    Coordinated-disclosure program; recognition-based. Small discretionary bonuses only for
    valid high/critical/exceptional out-of-scope findings.
disclosure_policy: >-
  Do not disclose a vulnerability before it has been fixed and announced, unless the Grafana
  Labs security team confirms you may.
evidence:
- {source: https://grafana.com/legal/report-a-security-issue/, kind: disclosure-page}
- {source: https://app.intigriti.com/programs/grafanalabs/grafanalabsvdp/detail, kind: bug-bounty}
- {source: https://grafana.com/blog/introducing-the-grafana-labs-bug-bounty-program/, kind: announcement}