Security Research
Prefect values the security research community. We treat security researchers as partners in keeping our platform secure.
Found a security issue? Send details to our security team:
bugbounty@prefect.ioOur bug bounty program covers the following Prefect-owned domains and services. Vulnerabilities in third-party integrations or services outside this scope are not eligible.
To qualify for our bug bounty program, security research must follow these guidelines. We appreciate researchers who conduct testing responsibly and in good faith.
Quality reports help us respond faster and fix issues effectively. Include as much detail as possible to help us understand and reproduce the vulnerability.
Vulnerability type
Classification and severity assessment
Affected domains/endpoints
Specific URLs or API endpoints
Reproduction steps
Detailed steps to reproduce the issue
Proof of concept
Screenshots, videos, or code samples
Your contact email
For follow-up communication
Proposed solutions
Optional but appreciated
Send your report to:
bugbounty@prefect.ioWe treat security researchers as valued partners in securing our platform.
Prompt acknowledgment
We acknowledge all valid reports
Partnership approach
Work with you to validate and fix issues
No legal action
Safe harbor for good faith research
Here's what you can expect from our team throughout the disclosure process.
We'll confirm we received your report and provide a tracking reference.
Our security team will work to reproduce and validate the vulnerability, and assess its severity.
We'll share an estimated remediation timeline and keep you updated on our progress.
Once the vulnerability is fixed, we'll notify you and discuss attribution if you'd like public recognition.
We value the time and effort security researchers invest in making Prefect more secure.
Prefect rewards the first reporter for a given issue. Compensation for discovered security vulnerabilities will be determined by Prefect based on:
Note: Rewards are determined on a case-by-case basis. Only the first reporter of a unique vulnerability is eligible for compensation.
Related security documentation and policies
Our security team is here to help. Contact us about program scope, reporting process, or any other questions about responsible disclosure.