HackWednesday

Bug Bounties

Top bug bounty programs and highest advertised rewards.

A curated page for security researchers, bug bounty hunters, students, and security teams tracking major public bug bounty programs, highest advertised rewards, AI security bounties, browser bounties, mobile bounties, cloud bounties, and official program rules.

A visual board of top bug bounty programs and rewards.
Headline rewards are useful signals, but actual payouts depend on exploitability, scope, severity, and report quality.

How to read this page

Reward ceilings are signals, not promises.

Many programs advertise a maximum reward for exceptional severity, full exploit chains, or unusual impact. Actual payouts vary by scope, report quality, affected product, reproducibility, and prior disclosure status. Always verify live terms directly on the official program page before investing serious research time.

Checked April 26, 2026Official sources onlyReward ceilings can change

Research strategy

Pick a program by scope quality, not only by maximum payout.

The highest paying bug bounty program is not always the best place to start. Researchers should compare scope clarity, response speed, safe-harbor language, duplicate risk, payout history, exploit complexity, and whether the target matches their skills. A $2M reward ceiling may be less practical than a smaller program with clear API scope and consistent triage.

Scope claritySafe harborTriage qualityReward historySkill fit

Current watchlist

Major public programs worth tracking.

#1Mobile / platformApple

Apple Security Bounty

Rewards reaching $2,000,000; potential maximum above $5,000,000 with bonuses

Apple continues to set one of the highest public ceiling rewards, especially for severe lock-screen bypass and zero-click style impact on modern devices.

Apple Security Bounty

#2Web / platformMeta

Meta Bug Bounty

Up to $300,000

Meta remains one of the biggest-name public programs and explicitly advertises six-figure payouts for exceptional impact.

Meta Bug Bounty

#3BrowserGoogle

Google Chrome VRP

Up to $250,000+

Google's Chrome VRP remains one of the most prestigious browser programs, with very high rewards for top-tier exploit chains and exceptional research quality.

Google VRP and 2025 rewards review

#4Mobile / AndroidGoogle

Google Mobile VRP

Up to $1,500,000 for top-tier Android/Chrome-class exploit chains

Google publicly notes very high Android and mobile-class rewards, making it one of the strongest programs for mobile exploit research.

Google VRP and 2024 rewards review

#5Cloud / enterpriseMicrosoft

Microsoft Bug Bounty Programs

Up to $250,000 across program categories

Microsoft's bug bounty portfolio spans cloud, identity, AI, and enterprise products, and its separate research events can make the total opportunity much larger.

Microsoft Bug Bounty Program

#6AI platformOpenAI

OpenAI Bug Bounty

OpenAI public article lists rewards up to $20,000; special campaigns may differ

OpenAI's program is highly relevant for researchers focused on AI product security, account issues, data exposure, and platform trust.

OpenAI Bug Bounty Program

Beginner path

How to use this list without wasting research time.

Start by reading each official scope, then choose one product area and build repeatable test notes. Avoid noisy scanning, customer-data access, denial-of-service testing, social engineering, and anything outside the program rules. The reports that earn rewards usually include clear reproduction steps, impact, affected assets, and a minimal proof of concept.

Read GitHub security checklistRead AI bug bounty guide