14 best bug bounty programs for developers in 2026

What bug bounty hunters get

Money and reputation. In 2022, a white hat who found a flaw in the Wormhole bridge was paid $10 million. That’s still the largest bug bounty ever paid. A strong HackerOne record or a hall-of-fame mention from Google opens doors to security jobs and access to invite-only private bug bounty programs.

#1. Apple Security Bounty

Apple doubled its top award to $2M in late 2025, aiming it squarely at the zero-click exploit chains that mercenary spyware relies on. Bonuses for beta software and Lockdown Mode bypasses can push a single payout past $5M. Rewards start at $1,000, and Apple has paid more than $35M to over 800 researchers since the program’s public launch in 2020.

#2. Google Bug Hunters

Google runs every product’s bounty from one portal, from Android and Chrome to Cloud and Gemini. It paid a record $17.1M to 747 researchers in 2025. A zero-click Pixel exploit tops the list at $1.5M, and a separate AI vulnerability reward program pays up to $30K for attacks on Gemini and Workspace. Google also prioritizes demonstrated security impact and working proofs of concept over theoretical vulnerabilities.

#3. Samsung Mobile Security Rewards

Samsung offers $200 to $1 million for vulnerabilities affecting Galaxy devices, One UI, and eligible Samsung apps. The top prize goes to researchers who can remotely compromise Knox Vault and access protected credentials. In 2025, Samsung paid $879,770 for roughly 450 valid reports. But a new hurdle emerged in September 2026: every submission must include a working proof of concept (PoC), after a surge in unverified, AI-generated vulnerability reports.

Hire senior pre-vetted Android and iOS developers to launch secure mobile apps to the App Store and Google Play faster.

#4. Meta Bug Bounty

Meta’s program covers Facebook, Instagram, WhatsApp, and Threads, plus newer targets like WhatsApp’s Private Processing for AI features. Mobile remote code execution pays up to $300K, and account takeovers pay up to $130K. Payouts nearly doubled in 2025 to more than $4M, and bonuses can add up to 30% on top.

#5. Microsoft Bounty Programs

Microsoft runs separate bounties for Windows, Azure, Microsoft 365, and Copilot, with rewards from $300. Endpoint and on-prem bugs pay up to $250K per report. The program has paid $20M to 562 researchers in its latest program year, and its Zero Day Quest hacking event carries a $5M pool for 2026.

#6. Shopify Bug Bounty

Shopify keeps a live counter of every dollar it pays: $10.2M all-time and $1.6M in 2026 so far. Critical bugs in the core platform earn up to $200K, with rewards starting at $500. For SaaS founders, it’s the clearest public picture of what a mature program costs.

#7. OpenAI Security Bug Bounty

OpenAI raised its top reward fivefold to $100K in March 2025 for exceptional critical findings in ChatGPT, the API, and its infrastructure. Rewards start at $200, and the program runs on Bugcrowd. Jailbreaks and agent safety issues go to a separate Safety Bug Bounty launched in March 2026.

Prompt injection and data leaks through AI agents now sit in scope at Google, Microsoft, OpenAI, and Adobe. If your product ships LLM features, those same bugs apply to you, and so does the need for AI engineers who build with them in mind.

#8. Salesforce Bug Bounty

Salesforce has run its bounty since 2015 and put $30.4M into it so far. 2025 was its biggest year yet: $6.2M paid to 696 researchers for more than 4,000 reports. Rewards start at $500, and the largest single payout to date is $60K. Researchers can earn more through targeted campaigns, which typically run for 1–4 weeks and offer 1.5–5× the standard bounty for specific products or vulnerability types.

#9. Anthropic Model Safety Bug Bounty

Anthropic’s program targets one thing: universal jailbreaks of the safety classifiers that protect Claude. A novel universal jailbreak earns up to $35K, up from $25K at launch in May 2025. Researchers apply to join and work under an NDA, and rewards start at $100.

#10. PayPal Bug Bounty

PayPal pays $50 to $30,000 per bug across PayPal and Braintree, with criticals at $20K-30K. Common issues like XSS and subdomain takeovers have fixed payouts, so researchers know what to expect before they submit. PayPal has paid researchers since 2012 and passed $6M by 2020.

#11. Mozilla Client Bug Bounty

Mozilla’s bounty covers Firefox and Thunderbird, and reports go straight into its public bug tracker, Bugzilla. A sandbox escape earns the top $20K, and bugs that also bypass a security mitigation get a 50% bonus. Rewards start at $500.

#12. Adobe Bug Bounty

Adobe moved its bounty to Intigriti on September 1, 2026, and has expanded its scope to AI security research. Rewards scale with severity and asset tier, from $100 up to $15K for exceptional bugs on Tier 1 assets. Adobe also pays higher rewards for account takeover vulnerabilities that let attackers access accounts across different organizations, rather than compromising just one user’s account.

#13. Atlassian Bug Bounty

Atlassian pays most for its core cloud products: Jira, Confluence, Bitbucket and Trello. Critical bugs on those Tier 1 products earn up to $10K, with rewards starting at $100. It also runs a Marketplace program on Bugcrowd, where Atlassian covers the platform costs for third-party app vendors.

#14. GitHub Security Bug Bounty

GitHub restructured its bounty in July 2026: public rewards now run from $250 to a fixed $10K for criticals. Bigger payouts of $30K and up moved to an invite-only VIP tier. To qualify, researchers need a track record of at least one critical, two high, four medium, or seven low-severity findings. Scope covers GitHub.com, Actions, and Copilot.

What is a bug bounty program?

A bug bounty program is a standing offer from a company: find a security vulnerability in our product, report it privately, and we’ll pay you. The people who take that offer are independent security researchers, often called ethical hackers or white-hat hackers.

Every program publishes a few ground rules:

• Scope: which products, domains, or apps researchers may test, also known as in-scope assets.
• Rules of engagement: what researchers can’t do, like touching real user data or running denial-of-service attacks. They establish boundaries for responsible testing.
• Reward table: how much each type of bug pays, usually tied to severity (low, medium, high, critical).
• Safe harbor: a promise not to take legal action against researchers who follow the rules.

After a researcher submits a vulnerability report, the company’s security team triages it to verify the finding, assess its impact, and determine whether it qualifies for a reward. The team then handles remediation (fixes the vulnerability) and may ask the researcher to retest the affected system. This process helps companies improve their overall security posture.

The highest rewards typically go to vulnerabilities that could compromise millions of devices, expose sensitive data, or put significant financial assets at risk. But advertised maximums are exceptional payouts that don’t happen every day.

Bug bounty program vs. vulnerability disclosure program

A vulnerability disclosure program (VDP) gives researchers an official channel to responsibly disclose vulnerabilities, but it doesn’t necessarily offer financial compensation. A bug bounty program adds cash rewards for qualifying vulnerabilities.

Both rely on a vulnerability disclosure policy that defines reporting procedures, authorized testing, and responsible disclosure expectations. Some organizations start with a VDP to establish a reporting process before introducing paid rewards.

Unlike penetration testing, where a company hires professionals to assess specific systems within a defined timeframe, bug bounty hunters are generally rewarded for valid findings rather than hours worked.

A bounty finds the bugs. In-house teams still have to fix them. Lemon.io matches you with vetted cybersecurity developers who can clear a vulnerability backlog, strengthen your stack before you launch a program, and handle bug reports as they come in.