Amazon bug bounty programs
amazon.com Updated
Amazon runs 4 public programs on HackerOne, its own site and security.txt; one pays cash, the most up to $30,000 (Amazon Vulnerability Research Program). 8 companies it owns, including Ring and eero, run 8 more programs.
- Top reward
- $30,000
- Ring, HackerOne
- Programs
- 12
- 4 pay cash
- Targets in scope
- 734
- 9 types, deduplicated
- Last change
- 12 Nov 2026
- 3 hours ago
Where to report
4 programs Amazon runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Amazon Web Services
Self-hosted · The company-wide program. Use it when no owned company's program fits.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Amazon Vulnerability Research Program
HackerOne · Bug bounty |
$30k (highest) | $8,000 (highest) | $4,000 (highest) | $500 (highest) | $30,000 | Partial | – | 6 days average | Open |
|
Amazon Web Services
Self-hosted · Disclosure only |
– | – | – | – | No cash | Full | – | 24 hours promised | Open |
|
AWS VDP
HackerOne · Disclosure only |
– | – | – | – | No cash | Full | – | 7 days average | Open |
|
Amazon Web Services (AWS)
security.txt · Disclosure only |
– | – | – | – | No cash | Full | – | 24 hours promised | Open |
-
- Critical
- $30k (highest)
- High
- $8,000 (highest)
- Medium
- $4,000 (highest)
- Low
- $500 (highest)
- Safe harbor
- Partial
- First response
- 6 days average
-
- Safe harbor
- Full
- First response
- 24 hours promised
-
- Safe harbor
- Full
- First response
- 7 days average
-
- Safe harbor
- Full
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Amazon owns
8 companies with 8 programs of their own. Each has its own scope and rules: report to the one that owns the asset.
-
$30k
Ring
HackerOne · Bug bounty
-
$30k
eero
HackerOne · Bug bounty
-
$25k
Audible
HackerOne · Bug bounty
-
No cash
AWS
Amazon Web Services (AWS)
security.txt · Disclosure only
-
No cash
Twitch
Self-hosted · Disclosure only
-
No cash
IMDb
Self-hosted · Disclosure only
-
No cash
Zoox
zoox.com
security.txt · Disclosure only
-
No cash
blinkforhome.com
Blinkforhome
Self-hosted · Disclosure only
What is in scope
734 targets across all 12 programs, each listed once with the programs that cover it. 33 excluded.
-
com.amazon.enterprise.access.android
Android Critical
Covered by Amazon Vulnerability Research Program
-
com.amazon.firetv.recast.blaster.aosp
Android Critical
Covered by Amazon Vulnerability Research Program
-
com.amazon.mShop.android.business.shopping
Android Critical
Covered by Amazon Vulnerability Research Program
-
com.amazon.primenow.seller.android
Android Critical
Covered by Amazon Vulnerability Research Program
-
com.amazon.shopperpanel.android.mobile.app
Android Critical
Covered by Amazon Vulnerability Research Program
-
com.amazon.storm.lightning.client.aosp
Android Critical
Covered by Amazon Vulnerability Research Program
-
com.amazon.vendormobile.india.android
Android Critical
Covered by Amazon Vulnerability Research Program
-
in.amazon.mShop.android.business.shopping
Android Critical
Covered by Amazon Vulnerability Research Program
-
Open-source software within a GitHub organization managed by Amazon or AWS.
Source code
Covered by Amazon Web Services, Amazon Web Services (AWS), Amazon Web Services (AWS)
-
Devices manufactured by Amazon or AWS and available to customers for purchase and use (e.g. Amazon Fire TV, Amazon Echo devices, Amazon Kindle, AWS Outpost).
Hardware and IoT
Covered by Amazon Web Services, Amazon Web Services (AWS), Amazon Web Services (AWS)
-
Amazon DocumentDB (with MongoDB compatibility)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Elastic Container Registry (Amazon ECR)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Elastic Container Service (Amazon ECS)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Elastic Kubernetes Service (Amazon EKS)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Interactive Video Service (Amazon IVS)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Managed Streaming for Apache Kafka (Amazon MSK)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Managed Workflows for Apache Airflow
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Managed Workflows for Apache Airflow (Amazon MWAA)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Quantum Ledger Database (Amazon QLDB)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Relational Database Service (Amazon RDS)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Relational Database Service (Amazon RDS) for Db2
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Route 53 Application Recovery Controller
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Services delivered by Amazon and publicly available to customers. (e.g. Amazon.com Seller API Service).
Products and areas
Covered by Amazon Web Services (AWS), Amazon Web Services (AWS), Amazon Web Services
-
Amazon Simple Notification Service (Amazon SNS)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Simple Workflow Service (Amazon SWF)
Products and areas Critical No bounty
Covered by AWS VDP
-
Amazon Subsidiaries (Please only actively test explicitly stated scope)
Products and areas Critical No bounty
Covered by Amazon Vulnerability Research Program
-
Amazon WorkSpaces Application Manager (Amazon WAM)
Products and areas Critical No bounty
Covered by AWS VDP
-
AWS Cloudfront https://aws.amazon.com/cloudfront/
Products and areas Critical No bounty
Covered by AWS VDP
-
AWS Directory Service for Microsoft Active Directory
Products and areas Critical No bounty
Covered by AWS VDP
-
AWS IAM Identity Center (successor to AWS Single Sign-On)
Products and areas Critical No bounty
Covered by AWS VDP
-
AWS Identity and Access Management Access Analyzer
Products and areas Critical No bounty
Covered by AWS VDP
-
AWS service providing managed private networks
Products and areas Critical No bounty
Covered by AWS VDP
-
AWS Services delivered by AWS and publicly available to customers. (e.g. Amazon EC2, Amazon RDS).
Products and areas
Covered by Amazon Web Services, Amazon Web Services (AWS), Amazon Web Services (AWS)
-
GenAI Apps under *.amazon.*
Products and areas Critical
Covered by Amazon Vulnerability Research Program
-
https://www.amazonpay.in/*
Products and areas Critical
Covered by Amazon Vulnerability Research Program
-
Other Amazon Retail Assets (Please only actively test explicitly stated scope)
Products and areas Critical No bounty
Covered by Amazon Vulnerability Research Program
-
Other Amazon Retail Mobile Apps (Please only actively test explicitly stated scope)
Products and areas Critical No bounty
Covered by Amazon Vulnerability Research Program
-
Other Amazon Retail Sites (Please only actively test explicitly stated scope)
Products and areas Critical No bounty
Covered by Amazon Vulnerability Research Program
-
Vector Engine for Amazon OpenSearch Serverless
Products and areas Critical No bounty
Covered by AWS VDP
No target matches. Try part of a host name, such as the company name.
Out of scope 33
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.*a2z*.*
Amazon Vulnerability Research Program
-
*.acx.com
Audible
-
*.aws.*
Amazon Vulnerability Research Program
-
*.dev
Amazon Vulnerability Research Program
-
acx-horizonte.audible.com
Audible
-
adobedtm.com
Audible
-
amazongames.com
Amazon Vulnerability Research Program
-
demdex.net
Audible
-
https://www.audible.com/ep/podcast-development-program
Audible
-
https://www.audiblehub.com/submit
Audible
-
newsletters.audible.com
Audible
-
omtrdc.net
Audible
-
www.audiblecareers.com
Audible
-
"Contact Us" Functionality
Amazon Vulnerability Research Program
-
Affiliate Programs
Audible
-
All Audible blogs across marketplaces
Audible
-
All help centers across marketplaces
Audible
-
Amazon Web Services (AWS)
Amazon Vulnerability Research Program
-
Any Denial of Service (DoS) attack against Amazon or AWS products (or Amazon or AWS customers)
Amazon Web Services Amazon Web Services (AWS) Amazon Web Services (AWS)
-
Any vulnerability obtained through the compromise of Amazon or AWS customer or employee accounts
Amazon Web Services Amazon Web Services (AWS) Amazon Web Services (AWS)
-
Anything considered a non-prod asset
Amazon Vulnerability Research Program
-
Anything not in scope
eero Ring
-
Anything which redirects to AWS
Amazon Vulnerability Research Program
-
AWS and AWS customer assets are strictly out of scope
Amazon Vulnerability Research Program
-
Devices
eero Ring
-
https://*.amazonaws.com/*
AWS VDP
-
Knowingly posting, transmitting, uploading, linking to, or sending malware
Amazon Web Services Amazon Web Services (AWS) Amazon Web Services (AWS)
-
learning.logistics.amazon.com
Amazon Vulnerability Research Program
-
Physical attacks against Amazon or AWS employees, offices, and data centers
Amazon Web Services Amazon Web Services (AWS) Amazon Web Services (AWS)
-
Pursuing vulnerabilities which send unsolicited bulk messages (spam)
Amazon Web Services (AWS) Amazon Web Services Amazon Web Services (AWS)
-
Services, Apps, Mobile
Ring eero
-
Social engineering of Amazon or AWS employees, contractors, vendors, or service providers
Amazon Web Services (AWS) Amazon Web Services Amazon Web Services (AWS)
-
Targeting assets of Amazon or AWS customers (or non-AWS sites hosted on AWS infrastructure)
Amazon Web Services Amazon Web Services (AWS) Amazon Web Services (AWS)
Recent changes
Reward and scope changes across every Amazon program, newest first.
-
Scope + security.txt
Added to scope: freertos.org
-
Scope + HackerOne
Added to scope: https://github.com/aws/s2n-quic
Recent CVEs
Published vulnerabilities in Amazon products, from the NVD.
-
CVE-2026-89332 Medium
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint
-
CVE-2026-89332 Medium
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint
-
CVE-2026-89332 Medium
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint
-
CVE-2026-18061 Medium
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remedia
-
CVE-2026-18061 Medium
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remedia
-
CVE-2026-18061 Medium
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remedia
-
CVE-2026-81838 Medium
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgra
-
CVE-2026-81838 Medium
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgra
About this page
This page gathers every public program listed under amazon.com and the companies Amazon owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Amazon.
Something wrong or missing? Report a correction.