Apple Security Bounty: rewards up to $2 million for Apple platform flaws
Apple pays up to $2 million, and over $5 million with bonuses, for proven security flaws in iPhone, Mac, iCloud and other Apple platforms. Reports are accepted at any time.
The Apple Security Bounty pays researchers who find and report security or privacy flaws in Apple devices, software and services. The top reward is $2 million for an exploit chain that reaches the kernel through a network attack with no user interaction. Bonuses can raise the maximum payout above $5 million.
Rewards depend on what the report can show. A one click attack from Safari that reaches the kernel can earn up to $1 million, and a WebContent sandbox escape up to $300,000. A wireless proximity attack on an Apple designed radio can earn up to $1 million. On the services side, unauthorized access to iCloud data on Apple servers can earn up to $1 million, and remote code execution up to $100,000. There are also rewards for macOS issues such as a Gatekeeper bypass, and for Private Cloud Compute.
To qualify, you must be the first to send Apple a complete and actionable report through the Apple Security Research site. The bug must affect the latest public version of an Apple operating system, including betas, on standard settings, or a service owned by Apple. The report needs a clear explanation, a working exploit or reliable proof of concept, and numbered steps to reproduce it. Some categories also need a Target Flag to earn the stated reward.
Target Flags are a way to prove that a bug can be exploited. Reports that use them get accelerated awards, which Apple processes before a fix is released. Bugs in new beta features may earn a 50 percent bonus, and a bypass of Lockdown Mode may earn a 100 percent bonus.
You submit and track reports online after you sign in with your Apple Account. Apple says most reports are resolved within 90 days. Low impact issues that Apple fixes anyway may still earn a $1,000 reward, plus credit and a CVE ID.
Quick answers
Are reports found with AI tools accepted?
Only if a person has validated them. Apple calls reports of theoretical issues or issues found by AI without proper validation ineligible, and repeated ineligible reports can pause your submissions for 180 days.
Can I publish my finding?
Not before Apple releases an update with a security advisory. Public disclosure before a fix makes the report ineligible for all rewards.
Can a reward go to charity?
Yes. Apple doubles rewards that researchers choose to donate to qualifying causes.