Focusing Our Bug Bounty Program on What Matters Most in the Age of AI
Tl;dr: AI has changed how vulnerabilities are found, and it's changing bug bounty programs industry-wide. Starting today, Low and Medium severity findings are no longer eligible for rewards on our HackerOne program, and we are adjusting High and Critical rewards to better reflect market trends. Under the updated structure, high-severity bugs will be eligible for up to $6,000, critical-severity bugs will receive up to $15,000, and extreme-severity reports will continue to be eligible for up to $1,000,000 in rewards. This change applies solely to our Web2 HackerOne program — our Web3 Cantina program remains unchanged.
For years, our bug bounty program has been one of our most important lines of defense — a way to put the skills of the world's best security researchers to work protecting our users and their assets. That partnership has produced real results, and it remains one we value deeply.
But the environment that program operates in has shifted dramatically over the past year. AI has changed who — or what — finds a "commodity" vulnerability, and it has changed how fast and how cheaply that can happen.
Of the reports we closed on our HackerOne program in the first half of this year, 44% were duplicates of something we already knew about, 37% were informative and not exploitable, and another 15% were deemed invalid. 4% of everything submitted was a valid bug we paid for. That's a lot of noise to sort through to find the signal — and it's why we're changing how the program works.
Today we're announcing changes to how our program is scoped and rewarded, so it keeps working for everyone: for the researchers who do genuinely hard, high-impact work, and for the security of the products our customers rely on.
What's changing
Effective immediately:
1. We're focusing the program on High, Critical, and Extreme severity findings. Low- and Medium-severity issues are moving out of scope for our public bug bounty program. Our own internal security tooling has matured and can catch this class of issue at scale, continuously.
2. We're rebalancing rewards for High and Critical findings to better reflect current market trends, while holding the line on our reward for the most severe class of vulnerabilities:
3. We're streamlining our internal review process for High- and Critical-severity reports, so researchers get faster, more decisive answers on submissions that matter most.
Reports already in our queue as of today will continue to be evaluated under the previous program terms.
What isn't changing
Our commitment to the security research community isn't going anywhere. We're keeping our $1,000,000 maximum reward for extreme-severity vulnerabilities unchanged. The vulnerabilities that matter most are still overwhelmingly found by researchers applying deep domain expertise and creativity that AI tooling can't yet replicate. If anything, we want this update to make our program more attractive to exactly that kind of researcher, by cutting through the noise and getting decisions made faster.
What this means for researchers
If you’ve been working on identifying high-impact security vulnerabilities, thank you for your work. Please stay the course. If you've historically focused on lower-severity, easily-automatable findings, now's the time to redirect that effort toward the vulnerabilities that genuinely move the needle. We believe this realigns incentives in a way that's better for the security of our customers and better for the researchers doing the work we value most.
Full, updated scope and reward details are available on our HackerOne program page. Our Cantina program for Web3 and smart contract vulnerabilities remains unchanged.
