Meta Bug Bounty scope

• Rewards for impactful findings is up to $300K USD.
• The Private Processing stack runs inside secure virtual environments designed to protect sensitive data.
• Setup guides and vetted testing artifacts are provided to help researchers get started quickly.
• Learn more about how WhatsApp uses confidential computing to protect user data in the WhatsApp Private Processing engineering blog post .

Please report feedback that is outside the scope of the bug bounty program through one of these channels:

• Adhere to our Responsible Research and Disclosure Policy and Safe Harbor Provisions (see above).
• Report a security bug: that is, identify a vulnerability in our services or infrastructure (see program scope above) which creates a security or privacy risk. (Note that Meta ultimately determines the risk of an issue, and that many software bugs are not security issues.) Report the vulnerability upon discovery or as soon as is feasible.
• Report a security bug involving one of the products or services that are within the scope of the program (see “Meta Bug Bounty scope” below). We specifically exclude certain types of potential security issues, listed under “Out of scope” and “False positives” (see below).
• Submit your report via our "Report a Security Vulnerability" form (one issue per report) and respond to any follow-up requests from our staff for updates or further information. Please do not contact our staff directly or through other channels about a report.
  • You will receive confirmation of our receipt of your report upon submission of the form.
• Use test accounts when investigating issues. If you cannot reproduce an issue with a test account, you can use a real account you are authorized to use (except for automated testing). Do not use or interact with any real account belonging to another person without explicit written consent of the account owner (e.g. do not test against Mark Zuckerberg’s account).
• Before engaging in any action which may be inconsistent with or unaddressed by these terms of service, contact us for clarification by submitting a new submission with your question.

• We investigate and respond to all valid reports. Due to the volume of reports we receive, though, we prioritize evaluations based on risk and other factors, and it may take some time before you receive a follow-up reply.
• We determine bounty amounts based on a variety of factors, including (but not limited to) impact, ease of exploitation, and quality of the report. If we pay a bounty, the minimum reward is $500*. Note that extremely low-risk issues may not qualify for a bounty at all. Even if the issue you identify is low-risk in isolation, if your report leads us to discover higher-risk vulnerabilities, we may, at our sole discretion, pay an increased award.
• We will generally pay lower reward amounts for in-scope vulnerabilities that are only exploitable through outdated versions of non-Meta developed software (e.g. a web browser), but we will still consider such reports.
• We seek to pay similar amounts for similar issues, but bounty amounts and qualifying issues may change with time. Past rewards do not necessarily guarantee similar results in the future.
• In the event of duplicate reports, we award a bounty to the first person to submit an issue. (Meta determines duplicates in its sole discretion and is not obligated to share details on prior similar reports.) A given bounty is typically only paid to one individual. However, if a subsequent report on a previously evaluated issue reveals that a vulnerability still remains or is more serious than initially judged, we may pay a reward for the subsequent report and evaluate whether an additional reward is warranted for the initial entry.
• You may donate a bounty to a recognized charity (subject to approval by Meta). In fact, we double bounty amounts that are donated in this way.
• We reserve the right to publish reports (and accompanying updates).
• We publish a list of researchers who have submitted valid security reports. You must receive a bounty to be eligible for this list, but your participation on the list is then optional. We reserve the right to limit or modify the information accompanying your name in the list.
• We verify that all bounty awards are permitted by applicable laws, including (but not limited to) US trade sanctions and economic restrictions.
• Meta may share report information, such as severity levels, payout amounts, and if you provide consent, Researcher ID with Bugcrowd and HackerOne for the purpose of processing bounty payouts.

We may retain any communications about security issues you report for as long as we deem necessary for program purposes, and we may cancel or modify this program at any time.

Qualifying individuals who submit a valid report to Meta that results in a payout according to these Terms will automatically be enrolled in our Hacker Plus rewards program for the opportunity to gain league status within the program and receive rewards, subject to verification and in accordance with the league in which they have qualified. There is no purchase necessary to participate in this program and a purchase will not increase your chances of receiving a reward. Participation in this program is void where prohibited by law. All rewards and participation are governed by our full Hacker Plus terms and conditions, which can be found here: https://bugbounty.meta.com/hackerplus/terms. Meta may offer features allowing participants to publicly display certain information about their participation in this program within a researcher profile, such as profile information, the league achieved, and related badges, points, score, signal-to-noise ratio, and other statistics. If you choose to share your information through this feature, this information will be public and others, including people without a Facebook account, may use it or share it with third parties.

The vulnerability is found in one of the following two ways:

The vulnerability must have some potential impact on Meta user data or systems (e.g. access token disclosure).

Whether we will pay any award in response to a report of a vulnerability affecting a third-party app or website (and if so, how much) is completely within our discretion. Factors that will influence our award decision include, but are not limited to, our ability to verify the vulnerability and ensure that it is remediated, the number of Facebook users potentially affected (we generally will only provide a bounty when over 200,000 Facebook users may be potentially affected), and the extent of the potential impact the vulnerability could have on Meta user data or systems if left unfixed. Receiving an award through the relevant third party's Meta Bug Bounty does not disqualify you from receiving an award through Meta Bug Bounty if submitted in compliance with these terms.

The main reasons why we close reports as invalid (informative/not applicable) are: