Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Mozilla bug bounty programs

firefox.com Updated Part of Mozilla

Mozilla runs one public program: a Sorona bug bounty paying up to $5,000.

Top reward
$5,000
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Mozilla runs.

  • Mozilla Accounts

    Sorona · Bug bounty

    Open

    Top reward

    $5,000
    Critical
    $5,000
    High
    $3,000
    Medium
    –
    Low
    –
    Safe harbor
    Partial
    First response
    2 hours promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://accounts.firefox.com

    Web

  • api.accounts.firefox.com, the auth server API, covering session and key-fetch tokens, the key wrapping that protects synced data, device and session records, recovery keys and account deletion

    Products and areas

  • Mozilla's HackerOne program lists accounts.firefox.com as a bounty-eligible asset with a maximum severity of critical. Its scope instruction names six further domains underneath it and closes with the line "Source Code: https://github.com/mozilla/fxa"

    Products and areas

  • oauth.accounts.firefox.com, the OAuth 2.0 and OpenID Connect surface: authorization and token endpoints, redirect handling, scopes, refresh tokens and relying-party registration

    Products and areas

  • profile.accounts.firefox.com and graphql.accounts.firefox.com, the profile and aggregated data layer where account data crosses a boundary

    Products and areas

  • subscriptions.firefox.com, the FxA-backed subscription platform and the billing authorisation behind it

    Products and areas

  • The content server at accounts.firefox.com: registration, login, password reset, account recovery, email verification and two-factor enrolment

    Products and areas

  • The shared packages in the mozilla/fxa monorepo those services are built from, which is the code Mozilla's own scope instruction points a researcher at

    Products and areas

  • verifier.accounts.firefox.com, the assertion verification that decides whether a claimed identity is genuine

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Aggressive scanning of production rather than testing on the staging instance a scope entry names

  • Bugs in third-party code that has not been incorporated into shipped Mozilla code

  • HackerOne's core ineligible findings, plus Mozilla's own custom scope exclusions layered on top

  • Lack of clickjacking protection on its own, and XSS that CSP blocks, which Mozilla rates low rather than high

  • Mozilla sites and services outside the program's listed assets, which pay only at critical severity and then at $500 to $1,000

  • Reports from anyone who contributed the buggy code, and from Mozilla employees or contractors

Recent changes

Reward and scope changes across every Mozilla program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under firefox.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.