Backblaze bug bounty programs
backblaze.com Updated
Backblaze runs two public programs: a Bugcrowd bug bounty paying up to $15,000 and a self-hosted bug bounty.
- Top reward
- $15,000
- Bugcrowd
- Programs
- 2
- 2 pay cash
- Targets in scope
- 9
- 5 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Backblaze
Bugcrowd · Pays the most of the 2 programs: up to $15,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Backblaze
Bugcrowd · Bug bounty |
$6,500 (highest) | $5,000 (highest) | $2,500 (highest) | $1,500 (highest) | $15,000 | Full | – | – | Open |
|
Backblaze
Self-hosted · Bug bounty |
– | – | – | – | Not published | None | – | – | Open |
-
- Critical
- $6,500 (highest)
- High
- $5,000 (highest)
- Medium
- $2,500 (highest)
- Low
- $1,500 (highest)
- Safe harbor
- Full
-
- Safe harbor
- None
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
9 targets across all 2 programs, each listed once with the programs that cover it.
-
https://play.google.com/store/apps/details?id=com.backblaze.android&hl=en_US&gl=US
Android
Covered by Bugcrowd
No target matches. Try part of a host name, such as the company name.
Recent changes
Reward and scope changes across every Backblaze program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Backblaze products, from the NVD.
-
CVE-2022-23651 Medium
b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. SDK users of the SqliteAccountInfo format are vulnerable while users of the InMemoryAccountInfo
-
CVE-2022-23653 Medium
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapp
-
CVE-2022-23651 Medium
b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. SDK users of the SqliteAccountInfo format are vulnerable while users of the InMemoryAccountInfo
-
CVE-2022-23653 Medium
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapp
-
CVE-2020-8290 High
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
-
CVE-2020-8290 High
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
-
CVE-2020-8289 High
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
-
CVE-2020-8289 High
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
About this page
This page gathers every public program listed under backblaze.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.