Report a security vulnerability

Airbyte welcomes reports of security vulnerabilities in Airbyte Cloud, which includes both the Airbyte Data Replication and Airbyte Agents platforms. Reports are submitted by invitation through Bugcrowd, our managed vulnerability disclosure platform. See Reporting a vulnerability for how to request one.

Our customers trust Airbyte with credentials to their own data systems and with the data that moves between them. Keeping that trust depends on working openly with the security research community. This policy explains what you may test, how to test safely on our production platform, how to report, and what you can expect from us in return.

We accept reports from anyone, including independent researchers, customers, partners, and vendors. For this policy, a vulnerability is a weakness in an in-scope Airbyte system that could compromise the confidentiality, integrity, or availability of Airbyte services or customer data.

Our commitments

If you follow this policy, we will:

• Review and triage every report submitted through our disclosure platform, and keep you informed through your submission.
• Treat your research as authorized and not pursue legal action against good-faith testing (see Safe harbor).
• Work with you to validate confirmed issues and fix them, prioritized by severity.
• Keep your report, and any customer data involved in it, confidential.
• Thank valid findings with a reward.

Scope

The following Airbyte Cloud targets are in scope, in both the US and EU regions.

Target	Platform	What it is
cloud.airbyte.com	Airbyte Data Replication	Web app for organizations, workspaces, sources and destinations, the Connector Builder, syncs, users and roles, SSO, and notifications
api.airbyte.com	Airbyte Data Replication	Public REST API, authenticated with application client credentials or bearer tokens
app.airbyte.ai	Airbyte Agents	Web app for connecting SaaS tools and querying or acting on them with AI agents
mcp.airbyte.ai	Airbyte Agents	MCP server, including its OAuth authorization, token, registration, and revocation endpoints

We may add or change targets as Airbyte Cloud evolves. The target list on our disclosure platform is the authoritative list of in-scope targets.

Vulnerabilities in open-source Airbyte code are in scope here when you demonstrate them against Airbyte Cloud. Useful references: product documentation, public API reference, and security documentation.

Rules of engagement

There is no separate test environment. You will be testing the live platform that our customers use, so these rules exist to keep them and their data safe.

Test accounts

• Sign up at cloud.airbyte.com and app.airbyte.ai with the researcher email address assigned to you by our disclosure platform. Aliases of that address are fine.
• Create at least two accounts, each with its own organization, to test isolation between tenants. One plays the attacker and one the victim, and both must be yours.
• To test lower roles, invite your second account into your organization or workspace.
• Airbyte does not provide paid subscriptions for testing. Test only the features available to the accounts you create.

Testing on production

• Interact only with accounts, organizations, and workspaces you created.
• Connect only sources and destinations you own or are authorized to use, and load them with test data. Do not use Airbyte to test third-party providers.
• Keep syncs small. Do not run large or high-frequency syncs, bulk loads, or anything that could degrade the platform or run up compute costs.
• Keep automated traffic under 10 requests per second, and include the researcher identification header described in the program brief on our disclosure platform.
• Do not make purchases or test billing flows with real payment methods.
• When you finish, remove what you created, including SSO configurations, OAuth clients, custom connectors, and webhooks.

Stop and report

• If you access another customer's data or credentials, stop immediately. Do not save, use, or share it. Report it right away with only the minimum evidence needed, then delete any copies you hold.
• If you gain code execution or a foothold in Airbyte infrastructure beyond your own connector job, do not pivot, escalate, or establish persistence. Report it immediately.

Prohibited activities and out-of-scope targets

The following activities are not authorized under this policy:

• Accessing, modifying, deleting, or exfiltrating data that belongs to anyone else, or more of your own data than you need to prove the issue.
• Denial of service, load or stress testing, and any activity that degrades, disrupts, or inhibits our services.
• Brute forcing logins, MFA codes, or tokens.
• Social engineering, such as phishing or pretexting, against Airbyte employees, contractors, or customers, and contacting Airbyte support or sales as part of your testing.
• Physical attacks against Airbyte people, offices, or equipment.
• Attacking third-party providers, including systems connected to Airbyte as sources or destinations and vendors Airbyte uses (for example Zendesk, Stripe, Segment, LaunchDarkly, Datadog, and our cloud providers).
• Establishing persistence, installing backdoors, or moving laterally inside Airbyte infrastructure.

The following targets are out of scope:

• airbyte.com, docs.airbyte.com, reference.airbyte.com, and any other Airbyte domain or subdomain not listed under Scope.
• Airbyte open source, when the issue does not reproduce on Airbyte Cloud. Report those through the Airbyte open source VDP instead.
• Third-party software and services, unless the vulnerability is exploitable through Airbyte's own code or configuration.

Ineligible findings

The following are not eligible for rewards and are usually closed as not applicable:

• Scanner or static analysis output, hypothetical exploit chains, and AI-generated reports without a working, human-verified reproduction.
• Code execution, file reads, environment access, or network access inside your own connector job, with no impact beyond it.
• A connector or webhook reaching a URL you configured, unless it reaches Airbyte-internal services or returns their data to you.
• Self-inflicted findings, where the attacker and the victim are the same party (see How we assess severity).
• Client-side keys designed to be public, such as Segment, LaunchDarkly client-side IDs, Datadog RUM, and the Zendesk widget, unless you use them to reach non-public data.
• Information we publish on purpose, such as Airbyte Cloud egress IP addresses and the public connector registry.
• Missing security headers or cookie flags, version disclosure, and descriptive error messages, without demonstrated impact.
• Clickjacking on pages without sensitive state-changing actions, logout CSRF, and missing CSRF tokens without a working proof of concept.
• Open redirects without impact beyond phishing.
• Email, user, or organization enumeration without further impact.
• Missing rate limits, unless they lead to account takeover or a comparable impact.
• Deprecated TLS versions or cipher suites without demonstrated exploitability.
• SPF, DKIM, or DMARC configuration.
• Password complexity, account recovery, and MFA enforcement policies.
• Attacks that require physical access to a victim's device, an already compromised account, or an end-of-life browser.
• Outdated dependency versions without a demonstrated exploit through Airbyte.
• AI model output quality, hallucinations, or jailbreaks that do not cross a security boundary.
• Known issues and duplicates.

How we assess severity

We rate findings on a standard P1 (critical) to P5 (informational) priority scale, adjusted for the boundary a finding crosses and what it gains by crossing it.

What matters most to us

• Tenant isolation. Organizations and workspaces must be fully isolated. Reading, changing, or running another organization's sources, destinations, connections, Connector Builder projects, logs, or synced data rates at the top of the range.
• Stored credentials. Once saved, source and destination credentials are write-only. Recovering a stored secret through the API, logs, Connector Builder testing values, error messages, or the MCP server rates at the top of the range.
• Connector job escape. Custom connectors, declarative manifests, and file-based connectors run code you control, by design, in isolated, short-lived job pods scoped to you. Severity depends on what that code can reach beyond your own pod: other tenants, platform or cloud credentials, the control plane, the database, cloud metadata services, or other workloads.
• Privilege escalation. A lower role, such as a workspace reader or organization member, performing actions reserved for a higher role.
• Authentication and SSO. Account takeover, login bypass, or binding SSO to a domain you do not own.
• Agents and MCP. Obtaining or reusing another user's MCP or OAuth tokens, making an agent act on another user's connected systems, or using prompt injection through data from a connected system to exfiltrate credentials or cross a tenant boundary.
• Server-side request forgery from Airbyte services, not your own connector job, to internal services.

Self-inflicted findings

Findings where the attacker and the victim are the same party are out of scope. This includes self-XSS and injection into a query, command, or request that a connector builds from configuration you supplied. Whoever can configure a source or destination already holds its credentials and can already run code in a connector job.

The exclusion turns on who supplied the value. Where it came from a source system, or from someone who never authenticated, the attacker and the victim are different parties and the finding is in scope.

If you are unsure which side of the line a finding falls on, report it. We will classify it and explain our reasoning either way.

Reporting a vulnerability

Airbyte Cloud reports are submitted in a private program on Bugcrowd, our managed vulnerability disclosure platform. To request an invitation, email vdp-cloud@airbyte.io with:

• The email address you registered your Bugcrowd account with, not your @bugcrowdninja.com address. If you do not have a Bugcrowd account yet, create one first.
• The affected target from the Scope table.
• A one-line summary of the issue.

Do not include technical details, proof of concept, or customer data in that email. Once you are invited, submit your full report in the private program. It is the only supported channel for Airbyte Cloud reports. If you contact an Airbyte employee directly instead, we will ask you to request an invitation.

Once invited, every report must include:

1. Step-by-step reproduction, with the exact requests and responses (HTTP or MCP JSON-RPC), performed by you against the current platform.
2. The organization IDs, workspace IDs, and account emails you used, and which accounts played attacker and victim. All of them must be yours.
3. The region (US or EU), where relevant.
4. The impact you demonstrated, and the access needed to start: unauthenticated, any user, or a specific role.
5. AI disclosure. State whether you used a large language model or other AI-assisted tool to find the issue or write the report. We do not penalize AI-assisted research, but the report still needs a human-verified proof of concept. Undisclosed AI-generated content found during triage will result in the report being closed.
6. A written description of the issue. Video, screenshots, and PDFs can supplement the text but not replace it.

Please combine findings that share one root cause into a single report. We assess and reward by root cause, not by the number of affected endpoints, parameters, or payloads.

What to expect

A dedicated triage team reviews each report first. They reproduce it, check it against known issues and earlier reports, and assign a priority before it reaches Airbyte's security team. All communication about your report happens in your submission on our disclosure platform.

We will tell you when your report is accepted, the priority we assigned, and when the issue is fixed. We do not commit to fixed remediation times. How quickly a report moves depends on its severity, its complexity, and how clearly it is reproduced. A well-documented report with a working proof of concept moves much faster than one we have to reconstruct.

Because Airbyte Cloud is a managed service, a fix protects every customer as soon as it is deployed. You do not need to wait for customers to upgrade.

Rewards

• Valid, in-scope findings receive a thank-you reward. It is a thank-you for responsible disclosure, not a market price for the finding.
• Only the first valid report of a root cause is rewarded. Later reports of the same root cause are duplicates.
• P5 and informational findings, out-of-scope findings, and known issues are not rewarded. We still review out-of-scope reports and act on them where warranted.
• Reports that break this policy, including its rules for production testing, are not rewarded.
• Current Airbyte employees and contractors are not eligible for rewards.
• Reward amounts and eligibility are at Airbyte's discretion.

Confidentiality and public disclosure

Keep your report, and everything you learn while testing, confidential. Do not disclose a finding publicly or to any third party without Airbyte's prior written approval.

Airbyte decides whether, when, and how a finding is disclosed, and may choose not to disclose it. Where the law or our contracts require it, we notify affected customers directly.

Safe harbor

When you conduct security research in good faith and in accordance with this policy, Airbyte:

• Considers your research authorized, including under applicable anti-hacking and anti-circumvention laws, and will not pursue or support legal action against you for it.
• Waives any restriction in our Terms of Service or acceptable use policies that would otherwise prevent research under this policy, for that limited purpose.
• Will make it known that your research was authorized if a third party brings legal action against you for activity that followed this policy.

Safe harbor covers Airbyte's own systems only. We cannot authorize testing of third-party systems, including those connected to Airbyte or used by Airbyte.

This policy does not authorize anything that breaks applicable law, including data protection laws such as the GDPR and CCPA. If you are unsure whether an action is covered, ask us through our disclosure platform before you proceed.

Related programs and changes to this policy

• Vulnerabilities in Airbyte open source that do not reproduce on Airbyte Cloud belong in the Airbyte open source VDP, which has its own scope and security model.
• Non-security bugs and support requests go to Airbyte support, not this program.
• We may update this policy at any time. The version on this page applies to reports submitted after it was published, and we keep it consistent with the program brief on our disclosure platform.