Question 1

WhatsApp Private Processing

Accepted Answer

Access is by invitation only to validate the security of Meta's Trusted Execution Environment, learn more about Private Processing. Rewards for impactful findings is up to $300K USD. The Private Processing stack runs inside secure virtual environments designed to protect sensitive data. Setup guides and vetted testing artifacts are provided to help researchers get started quickly. Learn more about how WhatsApp uses confidential computing to protect user data in the WhatsApp Private Processing engineering blog post.

Question 2

Meta AI

Accepted Answer

The bug bounty program is interested in reports that demonstrate integral privacy or security issues associated with Meta's large language models, including being able to leak or extract training data through tactics like model inversion or extraction attacks. Please report feedback that is outside the scope of the bug bounty program through one of these channels: Reporting issues with the functionality or operation of the model: github.com/facebookresearch/llama and github.com/facebookresearch/codellama/. Reporting risky content generated by the models to help improve Llama, please submit the prompt and response pair to: developers.facebook.com/llama_output_feedback/. Reporting violations of Acceptable Use policy or unlicensed uses of Llama models: llamausereport@meta.com

Question 3

Out of scope

Accepted Answer

Spam or social engineering techniques. Denial-of-service attacks. Content injection. Posting content on Facebook is a core feature, and content injection (also "content spoofing" or "HTML injection") is out of scope unless you can clearly demonstrate a significant risk. Security issues in third-party apps or websites that integrate with Meta technologies (including most pages on apps.facebook.com), except in the specific circumstances described in "Meta Bug Bounty scope" (see above). Executing scripts on sandboxed domains (such as fbrell.com or fbsbx.com). Using alert(document.domain) in your payload can help verify if the context is actually *.facebook.com. Mobile app crash reports that are not reproducible on up to date OS versions or mobile devices released within the last 2 calendar years.

Question 4

False positives

Accepted Answer

Open redirects. Any redirect using our Linkshim system is not an open redirect. Profile pictures available publicly. Your current profile picture is always public (regardless of size or resolution). Note that public information also includes your username, ID, name, current cover photo, gender, and anything you've shared publicly. Sending messages to anyone on Facebook. Accessing photos via raw image URLs from our CDN (Content Delivery Network). One of our engineers has posted a more detailed explanation (external link). Case-insensitive passwords. We accept the "caps lock" version of a password or with the first character capitalized to avoid login problems. Missing attribution on page posts. We generally show page admins which admin created a post, but this is not a security control.

Question 5

Meta Bug Bounty processes

Accepted Answer

We recognize and reward security researchers who help us keep people safe by reporting vulnerabilities in our products and services. Monetary bounties for such reports are entirely at the discretion of Meta, based on risk, impact, number of vulnerable users, and other factors. To be considered for a bounty, you must meet the following requirements: Adhere to our Responsible Research and Disclosure Policy and Safe Harbor Provisions. Report a security bug: that is, identify a vulnerability in our services or infrastructure which creates a security or privacy risk. Report a security bug involving one of the products or services that are within the scope of the program. Submit your report via our "Report a Security Vulnerability" form (one issue per report) and respond to any follow-up requests from our staff for updates or further information. Use test accounts when investigating issues. Before engaging in any action which may be inconsistent with or unaddressed by these terms of service, contact us for clarification by submitting a new submission with your question. In turn, we will follow these guidelines when evaluating reports under our Meta Bug Bounty: We investigate and respond to all valid reports. We determine bounty amounts based on a variety of factors, including impact, ease of exploitation, and quality of the report. If we pay a bounty, the minimum reward is $500*. We will generally pay lower reward amounts for in-scope vulnerabilities that are only exploitable through outdated versions of non-Meta developed software, but we will still consider such reports. We seek to pay similar amounts for similar issues, but bounty amounts and qualifying issues may change with time. In the event of duplicate reports, we award a bounty to the first person to submit an issue. You may donate a bounty to a recognized charity (subject to approval by Meta). In fact, we double bounty amounts that are donated in this way. We reserve the right to publish reports (and accompanying updates). We publish a list of researchers who have submitted valid security reports. We verify that all bounty awards are permitted by applicable laws, including US trade sanctions and economic restrictions. Meta may share report information, such as severity levels, payout amounts, and if you provide consent, Researcher ID with Bugcrowd and HackerOne for the purpose of processing bounty payouts. We may retain any communications about security issues you report for as long as we deem necessary for program purposes, and we may cancel or modify this program at any time. Qualifying individuals who submit a valid report to Meta that results in a payout according to these Terms will automatically be enrolled in our Hacker Plus rewards program for the opportunity to gain league status within the program and receive rewards, subject to verification and in accordance with the league in which they have qualified.

Question 6

Third party applications or websites

Accepted Answer

Vulnerabilities in third-party apps or websites that integrate with Meta technologies (including most pages on apps.facebook.com) are within scope only where the following conditions are met: The vulnerability is found in one of the following two ways: through passively viewing data sent to or from your device while using the app or website. You are not permitted to manipulate any request sent to the app or website from your device or to otherwise interfere with the ordinary functioning of the app or website in connection with the research supporting your report. OR other activity authorized by the third party responsible for the app or website, for example under the terms of the third party's own vulnerability disclosure or Meta Bug Bounty. Terms for Meta Bug Bounty do not provide any authorization allowing you to test an app or website controlled by a third-party. The vulnerability must have some potential impact on Meta user data or systems (e.g. access token disclosure). Whether we will pay any award in response to a report of a vulnerability affecting a third-party app or website (and if so, how much) is completely within our discretion.

Question 7

Conditions for closing reports as invalid

Accepted Answer

The main reasons why we close reports as invalid (informative/not applicable) are: The report is not describing a security issue, but rather a general software bug. Many software bugs are not security issues when they don't cause security or privacy risk. The report is describing a missing feature or a feature improvement suggestion. The issue reported is out of the scope of our bug bounty program. If you reported an issue that is not affecting Meta products, or the issue is caused by something that is out of Meta's control, it will not be eligible for our bug bounty program. The scenario described in the report is a social engineering scenario or a spam attack. We are aware of the risks caused by these attacks, and we are doing our best to monitor and prevent these attacks, but they are not considered in scope for our bug bounty program. The reported issue falls below the bar for a monetary reward.

Alcance del programa Meta Bug Bounty

Ejemplos del alcance del programa

Información importante

Más información