Security is a team effort, and we believe the security research community plays a vital role in keeping our platform and users safe. Today, we're thrilled to announce major enhancements to our bug bounty program, including significantly increased rewards, expanded scope, and improved processes that prioritize researcher experience.
Why Bug Bounties Matter
In 2025, the security landscape has never been more complex. According to recent industry data, companies distributing millions in bug bounty rewards have identified and resolved thousands of potential vulnerabilities before they could be exploited. The most successful programs understand that security researchers are partners, not adversaries, in the mission to build secure software.
Our bug bounty program has been running since 2023, but we've learned that simply having a program isn't enough. We need to create an environment where the world's best security researchers want to focus their attention on our platform. That requires competitive rewards, clear communication, and a commitment to treating researchers with the respect they deserve.
Dramatically Increased Rewards
We're more than doubling our maximum payouts to reflect the true value that security researchers provide. Our new reward structure recognizes both the severity of vulnerabilities and the quality of submissions:
New Reward Tiers
Critical Vulnerabilities: Up to $100,000
- Remote code execution on core infrastructure
- Authentication bypass affecting all users
- Data breach exposing sensitive user information
- Full account takeover vulnerabilities
High Severity: $25,000 - $50,000
- SQL injection in production systems
- Cross-site scripting (XSS) with significant impact
- Privilege escalation vulnerabilities
- Server-side request forgery (SSRF)
Medium Severity: $5,000 - $15,000
- Information disclosure of non-sensitive data
- Cross-site request forgery (CSRF)
- Security misconfigurations with demonstrated impact
- Denial of service vulnerabilities
Low Severity: $500 - $2,500
- Minor information leakage
- Best practice violations with security implications
- Low-impact vulnerabilities requiring significant user interaction
Bonus Multipliers
Following industry best practices, we're introducing bonus multipliers for exceptional submissions:
- Quality Bonus (up to 50%): Clear, detailed reports with proof-of-concept code and comprehensive remediation guidance
- First Discovery Bonus (25%): Being the first to report a specific vulnerability class
- Exploit Chain Bonus (up to 100%): Demonstrating full exploit chains that achieve real-world impact
- AI Security Bonus (50%): Vulnerabilities specific to our AI systems, including prompt injection and model manipulation
These multipliers can stack, meaning a critical vulnerability reported with exceptional detail could reach $200,000 in total rewards.
Significantly Expanded Scope
We're opening up more of our infrastructure to security research, recognizing that comprehensive coverage makes us all safer.
Now In Scope
Core Platform Infrastructure
- All production web applications and APIs
- Mobile applications (iOS and Android)
- Authentication and authorization systems
- Database infrastructure and data storage
- Internal admin panels and tools
AI and Machine Learning Systems
- AI model endpoints and inference systems
- Training data pipelines and storage
- Prompt injection and model manipulation
- AI-assisted content generation systems
- Machine learning model security
Cloud Infrastructure
- AWS, Google Cloud, and Azure deployments
- Kubernetes clusters and container security
- CDN and edge computing infrastructure
- CI/CD pipelines and deployment systems
Third-Party Integrations
- OAuth implementations
- SSO and SAML integrations
- Webhook delivery systems
- API integrations with partner services
Explicitly Out of Scope
To help researchers focus their efforts effectively, we've clearly defined what's outside our program:
- Social engineering attacks against our employees
- Physical security of our offices
- Denial of service attacks (unless you can demonstrate them safely)
- Spam or content manipulation
- Issues in third-party services we don't control
- Vulnerabilities requiring jailbroken or rooted devices
