A Major Evolution of Apple Security Bounty
Posted3 months agoActive3 months ago
security.apple.comTechstory
calmmixed
Debate
60/100
Apple Security BountyVulnerability DisclosureBug Bounty Programs
Key topics
Apple Security Bounty
Vulnerability Disclosure
Bug Bounty Programs
Apple has announced a major evolution of its Security Bounty program, which has sparked a mixed reaction from the security research community, with some appreciating the changes and others criticizing Apple's handling of past reports.
Snapshot generated from the HN discussion
Discussion Activity
Light discussionFirst comment
1h
Peak period
5
4-6h
Avg / period
2
Key moments
- 01Story posted
Oct 10, 2025 at 5:39 AM EDT
3 months ago
Step 01 - 02First comment
Oct 10, 2025 at 7:05 AM EDT
1h after posting
Step 02 - 03Peak activity
5 comments in 4-6h
Hottest window of the conversation
Step 03 - 04Latest activity
Oct 11, 2025 at 2:10 AM EDT
3 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 45536948Type: storyLast synced: 11/20/2025, 1:32:57 PM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
> We want those researchers to have an encouraging experience — so in addition to CVE assignment and researcher credit as before, we will now also reward such reports with a $1,000 award.
I submitted a few macOS reports to the program, but Apple just sat on them forever, sometimes years, until I got frustrated enough to just publicly disclose the bugs. Needless to say, Apple never paid me a dime. For that reason, I don't actively look for macOS bugs anymore, and if I happen to find anything by accident, I'll just 0day.
I think that demanding full exploit chains is an excuse to ignore bugs and to discourage researchers from reporting them. What if a full exploit chain exists, but the links of the chain are known by different researchers? The researchers are incentivized to withhold bug reports without the full chain, and meanwhile an attacker who happens to have the full chain won't withhold their attack. Apple is practically making the black market for bugs more valuable.
It's basically the same as Apple demanding a sysdiagnose before they'll even look at a non-security bug report. Typo in the developer documentation? Please attach a sysdiagnose! It's ridiculous.
People can be evil or good.
Individual chains of course are still eligible for rewards:
> Individual chain components or multiple components that cannot be linked together will remain eligible for rewards, though these are proportionally smaller to match their relative impact.
Edit:
I think those that build a full chain and attempt to sell to the regular posse would rather just take the bug bounty from Apple. There's little information about the 0day market for chains but from what I've seen it is you need to provide long term support and hoard alternative methods when different parts get discovered or break down. With MIE and other mitigations and vigilant scanning of devices, there's more chance exploits and techniques are discovered, patched, and you as VR/ED will only get a small fraction of the contract (like say $8m over a couple of years). (Someone from the 0day industry feel free to correct me.)