Bug Bounties
Security researchers search for best bug bounty programs, active bug bounty programs, bug bounty rewards, and highest paying bug bounty programs. This page gives a current, source-linked shortlist for students, researchers, and teams comparing where to spend serious research time.
Current rewards table
Use this table as a starting point, then click through to the official program page before testing. Reward ceilings are not guaranteed payouts.
| Program | Current advertised reward signal | Best fit | Official source |
|---|---|---|---|
| #1 Apple Security Bounty Mobile / platform | Rewards reaching $2,000,000; potential maximum above $5,000,000 with bonuses | Advanced exploit chains, Apple platform research, Lockdown Mode, PCC, mobile security | Apple Security Bounty categories |
| #2 Google Android and Devices VRP Mobile / Android | Up to $1,500,000 for zero-click full-chain Pixel Titan M2 compromise with persistence | Pixel, Android, firmware, hardware-backed security, persistence, zero-click research | Google: Android and Chrome VRPs for the AI era |
| #3 Coinbase Bug Bounty Crypto / fintech | Extreme-severity reports remain eligible for up to $1,000,000 | Crypto, fintech, account protection, high-impact Web2 and Web3 security research | Coinbase: bug bounty focus in the age of AI |
| #4 Google Chrome VRP Browser | Up to $250,000 for full-chain browser-process exploits; additional MiraclePtr bypass rewards can apply | Browser exploitation, sandbox escapes, memory safety, MiraclePtr bypass research | Google Chrome VRP rules |
| #5 Meta Bug Bounty Web / platform | Up to $300,000 for listed top mobile RCE category, before possible bonuses | Large-scale web, mobile, account security, platform abuse, and privacy-impact research | Meta Bug Bounty |
| #6 Microsoft Bug Bounty Programs Cloud / enterprise | Up to $250,000 across program categories | Cloud, identity, enterprise products, endpoint, on-prem, and Microsoft platform research | Microsoft Bug Bounty Program |
| #7 Shopify Bug Bounty Commerce / platform | Maximum bounty of $200,000 | Commerce, SaaS, web security, API security, and platform-impact reports | Shopify Bug Bounty |
| #8 OpenAI Bug Bounty AI platform | Up to $100,000 for exceptional and differentiated critical findings | AI platform security, account integrity, agent security, infrastructure, and abuse paths | OpenAI: Security on the path to AGI |
| #9 Intel Bug Bounty Hardware / firmware | $500 to $100,000, based on report quality, impact, severity, proof of concept, and vulnerability type | Hardware, firmware, platform security, silicon-adjacent vulnerabilities, and PoC quality | Intel Bug Bounty Program |
| #10 Anthropic Model Safety Bug Bounty AI safety / model security | Up to $35,000 per novel universal jailbreak in the model-safety program | Model safety, universal jailbreak research, AI abuse testing, and policy bypass evidence | Anthropic Model Safety Bug Bounty Program |
| #11 GitHub Bug Bounty Developer platform / supply chain | Critical issues list $10,000 in the public program and $30,000+ in private programs; exceptional reports may receive more | Developer platform security, GitHub Actions, package integrity, identity, and supply chain | GitHub Bug Bounty rewards |
Research workflow
Pick one official program, read scope first, then use the GitHub and AI security checklists to turn research into a reproducible report instead of noisy scanning.
Current watchlist
Ranked by a mix of advertised ceiling, strategic security impact, target quality, and current relevance to AI, cloud, developer, mobile, browser, crypto, and platform security research.
Rewards reaching $2,000,000; potential maximum above $5,000,000 with bonuses
Apple continues to advertise one of the highest public ceilings, especially for exploit chains resembling sophisticated spyware attacks, Lockdown Mode bypasses, beta findings, and Private Cloud Compute research.
Apple Security Bounty categoriesUp to $1,500,000 for zero-click full-chain Pixel Titan M2 compromise with persistence
Google's 2026 Android and Chrome VRP update keeps the highest Android rewards focused on hard, high-impact exploit chains rather than commodity AI-generated findings.
Google: Android and Chrome VRPs for the AI eraExtreme-severity reports remain eligible for up to $1,000,000
Coinbase's July 2026 update is a useful AI-era signal: low and medium issues moved out of the public bounty path while the top extreme-severity reward stayed at seven figures.
Coinbase: bug bounty focus in the age of AIUp to $250,000 for full-chain browser-process exploits; additional MiraclePtr bypass rewards can apply
Chrome remains a top-tier browser target, but Google's April 2026 rules update changed exploit-bonus limits, reproduction requirements, and reward structure.
Google Chrome VRP rulesUp to $300,000 for listed top mobile RCE category, before possible bonuses
Meta remains one of the biggest-name public programs and explicitly advertises six-figure payouts, plus possible Hacker Plus and other bonuses.
Meta Bug BountyUp to $250,000 across program categories
Microsoft's bug bounty portfolio spans cloud, identity, AI, and enterprise products, and its separate research events can make the total opportunity much larger.
Microsoft Bug Bounty ProgramMaximum bounty of $200,000
Shopify is a strong practical target for web, commerce, and platform researchers, with live program statistics and a clearly advertised maximum bounty.
Shopify Bug BountyUp to $100,000 for exceptional and differentiated critical findings
OpenAI's expanded maximum reward is an important signal for AI platform security research, especially high-impact infrastructure and product-security findings.
OpenAI: Security on the path to AGI$500 to $100,000, based on report quality, impact, severity, proof of concept, and vulnerability type
Intel is worth tracking for researchers focused on hardware, firmware, platform security, and product-security vulnerability handling.
Intel Bug Bounty ProgramUp to $35,000 per novel universal jailbreak in the model-safety program
Anthropic's program is a useful AI-specific watch item because it focuses on universal jailbreaks against deployed safeguards, not only traditional web vulnerabilities.
Anthropic Model Safety Bug Bounty ProgramCritical issues list $10,000 in the public program and $30,000+ in private programs; exceptional reports may receive more
GitHub is strategically important because its scope touches source control, Actions, packages, developer identity, and software supply-chain risk.
GitHub Bug Bounty rewards