New Relic is committed to the security of our customers and your data. We believe that engaging with security researchers through our coordinated disclosure program is an important measure to achieve our security goals.
If you believe you have found a security vulnerability in one of our products or websites, we welcome and thank you for reporting it through our coordinated disclosure program, as explained in this document. If you have other concerns, see the information about customer security issues.
Coordinated disclosure program
New Relic partners with established bug bounty platforms to make it as easy as possible for researchers to report security vulnerabilities to us. In recognition of the effort involved in finding these issues, we may provide bounties for eligible reports.
New Relic has officially transitioned our coordinated disclosure program to BugCrowd.
To participate in the coordinated disclosure program:
- You must agree to the Bugcrowd Researcher Terms & Conditions and ensure that you're familiar with and follow our Bugcrowd policies before initiating any security testing.
- You will be prompted to create a New Relic account that can be used only for permitted testing activity and with the applicable Terms of Service.
Vulnerability Reports & CVE Impact
Vulnerability scanning tools used by New Relic are tuned for our environment to help reduce false positives. Due to this, there may be variances between our scanning tools and vulnerabilities reported by another scanning report. For help evaluating a scan report, please raise a support case through the New Relic Support Portal and include the agent version, a detailed description of how the scan was conducted, the scanning tool used, special configuration considerations, and the exact report output.
Keeping customers secure is New Relic’s top priority. For the most up to date reporting on critical impacted CVEs for our agents, please review New Relic’s security bulletins and consider subscribing to New Relic’s Security notifications community channel or RSS feed.
Customer security issues
If you are a New Relic customer and have a security or other concern with respect to your services, including any password, API key, or account issue, do not use our coordinated disclosure program. Instead, please follow our standard troubleshooting procedures for password, email, and login problems or raise a security support case through the New Relic Support Portal.