Apple bug bounty programs

Apple programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Top reward	Safe harbor	KYC	First response	Status
AS Apple Security Bounty Self-hosted · Bug bounty	$5,000,000	–	–	–	Open

• AS

  Apple Security Bounty

  Self-hosted · Bug bounty

  Open

  Top reward

  $5M

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• apple.com

  Domains

  Covered by Self-hosted

• icloud.com

  Domains

  Covered by Self-hosted

• https://webkit.org

  Web

  Covered by WebKit

• https://webkit.org/blog

  Web

  Covered by JavaScriptCore

• https://www.swift.org

  Web

  Covered by Swift

• Apple devices, software, or services

  Products and areas

  Covered by Self-hosted

• Apple's declaration is outcome-based: the Security Bounty covers research across all Apple products and public-facing services, and the JavaScript engine running inside Safari's WebContent process is Source/JavaScriptCore in the open WebKit tree. A defect anywhere in that engine that a shipping Apple platform reaches is covered, priced at the Web Content code execution row of $10,000

  Products and areas

  Covered by JavaScriptCore

• Apple's declaration is outcome-based: the Security Bounty covers research across all Apple products and public-facing services, and the WebContent process on a shipping Apple device is WebKit. A bug anywhere in the github.com/WebKit/WebKit tree that Safari reaches on a shipped platform is covered. Apple pays for the effect on the platform rather than for the commit

  Products and areas

  Covered by WebKit

• Codable and the decoding path, which reconstructs typed objects from bytes

  Products and areas

  Covered by Swift

• Foundation and swift-corelibs-foundation, including the property list, JSON and XML decoders that parse untrusted data

  Products and areas

  Covered by Swift

• Graphics and media: WebGL and WebGPU, canvas, the media pipeline, image decoders and font handling, including the copies bundled inside the tree

  Products and areas

  Covered by WebKit

• JavaScriptCore, in the same repository under Source/JavaScriptCore and covered by the same Apple programme. It is listed separately on this site because its reachable ceiling is different

  Products and areas

  Covered by WebKit

• SIL, the optimiser and the code generation path down to LLVM, where a miscompilation can remove a bounds check or an exclusivity check the language guarantees

  Products and areas

  Covered by Swift

• swift-syntax and the macro plugin protocol, which runs a compiled plugin process during every build that uses a macro

  Products and areas

  Covered by Swift

• SwiftPM: manifest evaluation, dependency resolution, checkout, binary target handling, the plugin system and the build commands a package can declare

  Products and areas

  Covered by Swift

• The builtins and the standard library the engine implements: Array, Object, Proxy and Reflect, Map and Set, Date, Intl, Promises and the microtask queue, and module loading

  Products and areas

  Covered by JavaScriptCore

• The C and Objective-C interoperability layers and the bridging code between them

  Products and areas

  Covered by Swift

• The compiler front end: the parser, the type checker and the macro expansion machinery, which runs macro plugin code during compilation

  Products and areas

  Covered by Swift

• The concurrency runtime, actors and the isolation checking that is supposed to prevent data races

  Products and areas

  Covered by Swift

• The embedder surfaces Apple ships on top of the engine: the JavaScriptCore C and Objective-C APIs in JavaScriptCore.framework, and the engine as it executes inside WKWebView

  Products and areas

  Covered by JavaScriptCore

• The full compilation pipeline as it ships: the parser and bytecode generator, the LLInt interpreter, the Baseline compiler, and the DFG and FTL/B3 optimising tiers

  Products and areas

  Covered by JavaScriptCore

• The loader and networking layer: URL parsing, resource loading, redirect handling, CORS, Content Security Policy, cookies and the cache, together with the security-origin checks the loader and the DOM both rely on

  Products and areas

  Covered by WebKit

• The Riptide garbage collector and the allocators beneath it, including finalisation and the weak-reference machinery

  Products and areas

  Covered by JavaScriptCore

• The runtime and object model: structures and structure IDs, property storage, inline caches and prototype chains, together with the gigacage and Structure ID randomisation mitigations that harden them

  Products and areas

  Covered by JavaScriptCore

• The Swift runtime: reference counting, metadata handling, dynamic casting and the reflection machinery

  Products and areas

  Covered by Swift

No target matches. Try part of a host name, such as the company name.