Bug Bounties
Find a program that fits your skills, not just the biggest reward. Compare research areas and advertised ceilings, then verify the official scope, eligibility and reporting rules before you test.
Current rewards table
Use this table as a starting point, then click through to the official program page before testing. Reward ceilings are not guaranteed payouts.
Showing 13 programs in the table. Check individual eligibility before testing.
| Program | Advertised reward ceiling | Best fit | Official source |
|---|---|---|---|
| Apple Security Bounty Mobile / platform | Rewards reaching $2,000,000; potential maximum above $5,000,000 with bonuses | Advanced exploit chains, Apple platform research, Lockdown Mode, PCC, mobile security | Apple Security Bounty categories Last verified: September 5, 2026 |
| Google Android and Devices VRP Mobile / Android | Up to $1,500,000 for zero-click full-chain Pixel Titan M2 compromise with persistence | Pixel, Android, firmware, hardware-backed security, persistence, zero-click research | Google: Android and Chrome VRPs for the AI era Last verified: September 5, 2026 |
| Coinbase Bug Bounty Crypto / fintech | Extreme-severity reports remain eligible for up to $1,000,000 | Crypto, fintech, account protection, high-impact Web2 and Web3 security research | Coinbase: bug bounty focus in the age of AI Last verified: September 5, 2026 |
| Google Chrome VRP Browser | Up to $250,000 for full-chain browser-process exploits; additional MiraclePtr bypass rewards can apply | Browser exploitation, sandbox escapes, memory safety, MiraclePtr bypass research | Google Chrome VRP rules Last verified: September 5, 2026 |
| Meta Bug Bounty Web / platform | Up to $300,000 for listed top mobile RCE category, before possible bonuses | Large-scale web, mobile, account security, platform abuse, and privacy-impact research | Meta Bug Bounty Last verified: September 5, 2026 |
| Microsoft Bug Bounty Programs Cloud / enterprise | Up to $250,000 across program categories | Cloud, identity, enterprise products, endpoint, on-prem, and Microsoft platform research | Microsoft Bug Bounty Program Last verified: September 5, 2026 |
| Shopify Bug Bounty Commerce / platform | Maximum bounty of $200,000 | Commerce, SaaS, web security, API security, and platform-impact reports | Shopify Bug Bounty Last verified: September 5, 2026 |
| OpenAI Bug Bounty AI platform | Up to $100,000 for exceptional and differentiated critical findings | AI platform security, account integrity, agent security, infrastructure, and abuse paths | OpenAI: Security on the path to AGI Last verified: September 5, 2026 |
| Intel Bug Bounty Hardware / firmware | $500 to $100,000, based on report quality, impact, severity, proof of concept, and vulnerability type | Hardware, firmware, platform security, silicon-adjacent vulnerabilities, and PoC quality | Intel Bug Bounty Program Last verified: September 5, 2026 |
| Anthropic Model Safety Bug Bounty AI safety / model security | Up to $35,000 per novel universal jailbreak in the model-safety program | Model safety, universal jailbreak research, AI abuse testing, and policy bypass evidence | Anthropic Model Safety Bug Bounty Program Last verified: September 5, 2026 |
| Microsoft Copilot Bounty AI product security | $250 to $30,000; higher discretionary awards may apply | Copilot access controls, information disclosure and AI-specific security impact Use a personal test account and follow MSRC eligibility and disclosure rules. Self-only prompt injection, system-prompt extraction and content-only issues are excluded. | Microsoft Copilot scope and reward rules Last verified: September 22, 2026 |
| Google AI Vulnerability Reward Program AI security / abuse | Base rewards up to $20,000; report-quality adjustments and discretionary novelty bonuses apply | Unauthorized agent actions, sensitive data exposure and cross-account context manipulation Test only your own accounts. Participation is 18+ (an adult may submit for a minor), with geographic restrictions. Standard jailbreaks, hallucinations and non-sensitive prompt extraction do not qualify. | Google AI VRP scope and reward rules Last verified: September 22, 2026 |
| GitHub Bug Bounty Developer platform / supply chain | Critical issues list $10,000 in the public program and $30,000+ in private programs; exceptional reports may receive more | Developer platform security, GitHub Actions, package integrity, identity, and supply chain | GitHub Bug Bounty rewards Last verified: September 5, 2026 |
Research workflow
Pick one official program, read scope first, then use the GitHub and AI security checklists to turn research into a reproducible report instead of noisy scanning.
Current watchlist
A research shortlist spanning AI, cloud, developer, mobile, browser, crypto and platform security. Display order is not a payout ranking.
Rewards reaching $2,000,000; potential maximum above $5,000,000 with bonuses
Apple continues to advertise one of the highest public ceilings, especially for exploit chains resembling sophisticated spyware attacks, Lockdown Mode bypasses, beta findings, and Private Cloud Compute research.
Apple Security Bounty categoriesUp to $1,500,000 for zero-click full-chain Pixel Titan M2 compromise with persistence
Google's 2026 Android and Chrome VRP update keeps the highest Android rewards focused on hard, high-impact exploit chains rather than commodity AI-generated findings.
Google: Android and Chrome VRPs for the AI eraExtreme-severity reports remain eligible for up to $1,000,000
Coinbase's July 2026 update is a useful AI-era signal: low and medium issues moved out of the public bounty path while the top extreme-severity reward stayed at seven figures.
Coinbase: bug bounty focus in the age of AIUp to $250,000 for full-chain browser-process exploits; additional MiraclePtr bypass rewards can apply
Chrome remains a top-tier browser target, but Google's April 2026 rules update changed exploit-bonus limits, reproduction requirements, and reward structure.
Google Chrome VRP rulesUp to $300,000 for listed top mobile RCE category, before possible bonuses
Meta remains one of the biggest-name public programs and explicitly advertises six-figure payouts, plus possible Hacker Plus and other bonuses.
Meta Bug BountyUp to $250,000 across program categories
Microsoft's bug bounty portfolio spans cloud, identity, AI, and enterprise products, and its separate research events can make the total opportunity much larger.
Microsoft Bug Bounty ProgramMaximum bounty of $200,000
Shopify is a strong practical target for web, commerce, and platform researchers, with live program statistics and a clearly advertised maximum bounty.
Shopify Bug BountyUp to $100,000 for exceptional and differentiated critical findings
OpenAI's expanded maximum reward is an important signal for AI platform security research, especially high-impact infrastructure and product-security findings.
OpenAI: Security on the path to AGI$500 to $100,000, based on report quality, impact, severity, proof of concept, and vulnerability type
Intel is worth tracking for researchers focused on hardware, firmware, platform security, and product-security vulnerability handling.
Intel Bug Bounty ProgramUp to $35,000 per novel universal jailbreak in the model-safety program
Anthropic's program is a useful AI-specific watch item because it focuses on universal jailbreaks against deployed safeguards, not only traditional web vulnerabilities.
Anthropic Model Safety Bug Bounty Program$250 to $30,000; higher discretionary awards may apply
Covers specified consumer Copilot experiences, including web, Edge, mobile and Windows. Reports need demonstrable security impact, not merely unusual model output.
Use a personal test account and follow MSRC eligibility and disclosure rules. Self-only prompt injection, system-prompt extraction and content-only issues are excluded.
Microsoft Copilot scope and reward rulesBase rewards up to $20,000; report-quality adjustments and discretionary novelty bonuses apply
A dedicated program for AI-related vulnerabilities in eligible Google products, including Gemini, Search and Workspace. Google Cloud issues generally follow the separate Cloud VRP.
Test only your own accounts. Participation is 18+ (an adult may submit for a minor), with geographic restrictions. Standard jailbreaks, hallucinations and non-sensitive prompt extraction do not qualify.
Google AI VRP scope and reward rulesCritical issues list $10,000 in the public program and $30,000+ in private programs; exceptional reports may receive more
GitHub is strategically important because its scope touches source control, Actions, packages, developer identity, and software supply-chain risk.
GitHub Bug Bounty rewards