Programs
Companies
Microsoft

Microsoft bug bounty programs

microsoft.com Updated 12 Nov 2026

Microsoft runs 5 public programs on Sorona and its own site; 5 pay cash, the most up to $250,000 (Microsoft Bounty Program). 3 companies it owns, including GitHub and LinkedIn, run 76 more programs.

Top reward: $250,000; Self-hosted
Programs: 81; 76 pay cash
Targets in scope: 827; 9 types, deduplicated
Last change: None yet; Tracked since Nov 2026

Where to report

5 programs Microsoft runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Microsoft Bounty Program

Self-hosted · The company-wide program. Pays up to $250,000.

Microsoft programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.
Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
Microsoft Bounty Program Self-hosted · Bug bounty	–	–	–	–	$250,000	Full	–	–	Open
.NET Sorona · Bug bounty	$40k (highest)	–	–	–	$40,000	Partial	–	–	Open
PowerShell Sorona · Bug bounty	$15k	–	–	–	$15,000	Partial	Required	–	Open
Fluent UI Sorona · Bug bounty	$15k	–	–	–	$15,000	Partial	Required	–	Open
Microsoft Agent Framework Sorona · Bug bounty	$15k	–	–	–	$15,000	Partial	Required	–	Open

Microsoft Bounty Program
Self-hosted · Bug bounty

Open

Top reward
$250k

Safe harbor

Full
.NET
Sorona · Bug bounty

Open

Top reward
$40k

Critical

$40k (highest)

High

–

Medium

–

Low

–

Safe harbor

Partial
PowerShell
Sorona · Bug bounty

Open

Top reward
$15k

Critical

$15k

High

–

Medium

–

Low

–

Safe harbor

Partial

KYC

Required
Fluent UI
Sorona · Bug bounty

Open

Top reward
$15k

Critical

$15k

High

–

Medium

–

Low

–

Safe harbor

Partial

KYC

Required
Microsoft Agent Framework
Sorona · Bug bounty

Open

Top reward
$15k

Critical

$15k

High

–

Medium

–

Low

–

Safe harbor

Partial

KYC

Required

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

Companies Microsoft owns

3 companies with 76 programs of their own. Each has its own scope and rules: report to the one that owns the asset.

What is in scope

827 targets across all 81 programs, each listed once with the programs that cover it. 426 excluded.

No target matches. Try part of a host name, such as the company name.

Out of scope 426

Don't test these. A program can exclude a host another program covers; the program you report to decides.

*.github.io

GitHub
*.gocd.org

GoCD
blog.github.com

GitHub
community.github.com

GitHub
enterprise.github.com

GitHub
git.io

GitHub
github.blog

GitHub
http://education.github.com/forum

GitHub
shop.github.com

GitHub
spectrum.chat

GitHub
Atom

GitHub
Electron

GitHub
GitHub Classroom Assistant

GitHub
"Use of unsupported platforms, unreleased versions, or non-standard build processes", quoted from the policy's out-of-scope list: build it the way the project builds it

Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)
@Beta-annotated APIs, where the project states the contract is explicitly unstable

Guava
A cluster deliberately deployed without ACLs enabled and with admin endpoints on a public interface, where the finding is the deployment decision

Dgraph
A consuming application's own misuse of the component APIs

Fluent UI
A crash on malformed input with no demonstrated gain in privilege, which the program treats as an unfinished report rather than a finding

NVIDIA Container Toolkit
A defect already covered by another vendor's bounty program, which MSRC declines to pay for a second time

PowerShell
A distribution's choice of default PAM stack, which is configuration by the distributor rather than a defect in the code

Linux-PAM
A DNS provider's own API behaviour rather than lego's integration with it

go-acme/lego
A Dockerfile that does something dangerous the author asked for, such as running an untrusted script during a build the author controls

BuildKit
A finding already covered by an open or published advisory, which the first-come-first-served duplicate policy will close

xrdp
A patch the maintainers decline, since the reward panel states it will not second-guess a maintainer's decision

Deno Wasmtime
A patch the maintainers decline: the reward panel states it will not second-guess a maintainer's decision, so an unmerged patch is worth nothing however good it is

Ruby (CRuby)
A patch the maintainers or the Strike Team decline, since the reward panel states it will not second-guess a maintainer's decision

Joomla
A project author writing a macro or a model that executes SQL with the credentials they configured, which is what dbt does

dbt-core
A user who explicitly enabled allow_remote_control and is then remote-controlled as documented, unless the finding shows that boundary failing

kitty
A vulnerability report on its own where the patch money is concerned: that rail pays only on a change merged upstream that then survives a month without reverts

PrestaShop
A warehouse role granted more privilege than it needed, which is a configuration decision by the operator

dbt-core
A weak policy a caller wrote deliberately, such as a runtime that allowlists a dangerous syscall on purpose

libseccomp
Accessibility, layout and visual defects with no security impact

Fluent UI
ActiveJob, Sidekiq, Resque and the other queue backends, which are other projects' code even where job-iteration drives them

Shopify job-iteration
ActiveRecord and Rails behaviour that identity_cache only inherits, which belongs upstream

Shopify identity_cache
Adobe's other products, which sit on other asset rows of the same HackerOne program rather than on this one

Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative) Adobe Commerce Open Source (Magento Open Source)
Amazon retail properties, devices and consumer applications, which the AWS VDP policy explicitly sends to Amazon's separate public bug bounty programme

AWS-LC
Amazon retail, device and consumer application reports, which the AWS VDP policy sends to a separate programme

s2n-tls
An application's decision to accept a signature xmlsec correctly reported as covering only part of the document

xmlsec
An operator deliberately exposing an internal service through a tunnel, which is what the product does rather than a defect

frp
An operator's deliberate configuration choice, such as pointing the webroot provider at a directory the web server executes from

go-acme/lego
Anything already covered by a published advisory, given how much of this surface was rewritten during 2026

Dgraph
Anything already covered by one of the seven published advisories

kitty
Anything already publicly disclosed before the submission, and dependency-confusion reports

TypeScript
Anything already reported, ruled out by name in the policy's exclusions list

Vaultwarden
Anything filed as a public issue, which the policy asks reporters to avoid

Jackson
Anything in kubernetes/autoscaler beyond the core autoscaling loop, the Vertical Pod Autoscaler and addon-resizer, since those are the components the program pays on

Cluster Autoscaler
Anything in the archived or example crates carried in the repository

Cloudflare Pingora
Anything other than the most recent release, which is the only version the program will grade

Tiered Storage for Apache Kafka
Anything outside the repositories the archived scope named: ntpd-rs, clock-steering and timestamped-socket

ntpd-rs (Project Pendulum)
Anything outside the repository the OSS-Fuzz integration names as main_repo, since the Tier 2 scope line attaches to that repository and nothing else

Wasmtime
Anything outside the repository the OSS-Fuzz integration names as main_repo: the Tier 2 scope line attaches to that repository and nothing else

Deno
Anything outside the swiyu public beta trust infrastructure and the components the programme names. The exact asset list sits behind the app.bugbounty.ch login, so treat anything you have not seen on it as out until you have

swiyu (Swiss e-ID and Trust Infrastructure)
Anything reachable only with a self-hosted or modified build of dependabot-core

Dependabot Core
Anything reproducible only on main or on a pre-release build, which the policy classifies as a regular issue

Exiv2
Anything requiring administrative or root OS privileges to exploit in the first place

Kibana
Anything that only reproduces on a version other than the current one, since the program covers the latest release

XNNPACK
Anything that only reproduces under a non-default configuration, since the in-scope wording is anchored to default configurations

Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)
Anything that requires contacting Shopify Support to demonstrate, which is itself a disqualifier

Shopify job-iteration
Application code that misuses a ThreadX API in a way the documentation warns against

Eclipse ThreadX
Application-layer findings shown only on a deployment below the 1 CPU and 2 GB RAM floor the program requires

Kibana
Application-level bugs in code written in Ruby, as opposed to defects in the interpreter that runs it

Ruby (CRuby)
Application-level denial of service, excluded by the program's baseline for all targets

Tiered Storage for Apache Kafka
Application-side API misuse: an embedding application that skips the host-key check or ignores a return value and reports the consequence

libssh2
Application-side misuse of intentionally dangerous functions: passing request data to eval, include, system or unserialize and reporting the consequence

PHP
Applications that choose to call fromJson on untrusted data into unsafe target types

Gson
Applications that choose to compile attacker-supplied patterns without setting a max_mem limit

RE2
Applications that deliberately raise or disable MAX_IMAGE_PIXELS and then run out of memory, which is the operator's decision

Pillow
Applications that enable default typing over untrusted input and then bind to a permissive base type, where Jackson behaved exactly as configured and documented

Jackson
Applications that use Guava insecurely, as opposed to defects in Guava's own behaviour

Guava
Aqua Security's commercial platform, a separate product with a separate report surface

Trivy
Assets from Elastic acquisitions closed within the last six months

Kibana
Attacks relying on insecure configurations, subject to the Security Response Committee's opinion

Cluster Autoscaler
Attacks requiring invasive physical access to a card, such as fault injection or decapping

OpenSC
Attacks requiring physical access to the host

Vaultwarden
Attacks that assume a compromised host or an attacker who already holds the private key

s2n-tls
Attacks that need physical access to the victim's machine, a man in the middle, or an already-compromised account

NVIDIA Container Toolkit
Awards are gated on sanctions screening, so a reporter who cannot clear it will not be paid however good the finding

Dependabot Core
Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay

XNNPACK
Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue

Brotli Gson Distroless
AWS service configuration and the operational estate rather than a defect in this library's source

AWS-LC
AWS services and their configuration rather than a defect in this library

s2n-tls
Azure RTOS releases predating the Eclipse donation, along with Microsoft's own downstream products built on them

Eclipse ThreadX
Badger and other upstream dependency defects, unless Dgraph's own use of them is what makes the issue reachable

Dgraph
Behaviour an application deliberately opted into by enabling a documented lenient flag, unless the flag is more permissive than it is documented to be

llhttp
Behaviour differences from Jackson that carry no independent security impact

Gson
Behaviour the shared-responsibility threat model assigns to the calling application, unless the documentation leads a careful caller into it

s2n-tls
Best-practice and non-security findings, and duplicates that share a root cause with an existing submission

Shopify job-iteration
Best-practice observations, and duplicates sharing a root cause with a report already filed

Shopify identity_cache
Bugs in HarfBuzz, FreeType or fontconfig, which libass calls but does not own

libass
Bugs in libFLAC, libvorbis, libogg or libmpg123 rather than in libsndfile's use of them

libsndfile
Bugs in TensorFlow Lite, PyTorch or another framework that merely calls XNNPACK, which belong to the calling project's own program

XNNPACK
Bugs in the player embedding libass rather than in the library

libass
Bugs in the Python wrappers, soundfile and librosa, which are separate projects on top of this library

libsndfile
Bugs inherited from a forked upstream project rather than introduced by this plugin

Tiered Storage for Apache Kafka
Bugs that first require a GitHub organisation owner to be compromised

Dependabot Core
Bugs that require a build configuration nobody ships, without a route to the same defect in a default build

libheif
Build system and packaging issues rather than upstream library code

libsndfile
Building from an index the user asked uv to use, likewise ruled out by name

uv
BuildKit, which ships as a separate project with its own policy and its own entry here

Docker Engine
Bundling several unrelated issues into one report, which the policy's one-advisory-per-issue rule rules out

OpenSC
Callers that extract into a directory they do not control, or that disable the library's own path protections and then get what they asked for

node-tar
Catastrophic-backtracking reports, since RE2's entire design guarantee is linear-time matching and the absence of backtracking

RE2
Client libraries maintained in separate repositories, where the defect is in the binding rather than the server

Dgraph
Client-side tooling such as Docker Engine, Podman or Skopeo, which have their own entries here

Distribution
Cloud-provider infrastructure issues in S3, GCS or Azure Blob rather than in this plugin's use of them

Tiered Storage for Apache Kafka
Community adapters and community packages published on the hub that dbt Labs does not maintain

dbt-core
Compiler Object Tools, which NVIDIA places outside the compiler threat model because they are standalone development and diagnostic tools

NVIDIA Container Toolkit
Compression side channels of the CRIME and BREACH family, which are a protocol-level property rather than a defect in this codec

Brotli
Compression-ratio and performance issues without security impact

Brotli
Compression-ratio denial of service inherent to gzip or tar rather than to this implementation

node-tar
Configuration mistakes in /etc/fstab or in a distribution's sudoers rules that grant mounting rights the operator chose to grant

util-linux
Configuration mistakes in somebody else's PrestaShop deployment rather than a defect in the shipped code

PrestaShop
Configurations the operator deliberately weakened: a policy that grants a capability, mounts a writable host path or permits a syscall is doing exactly what it was told

nsjail
Container parsing, which belongs to libheif or to whichever demuxer produced the bitstream

libde265
Container runtime and host kernel escapes, which these images neither implement nor mediate

Distroless
containerd and runc, which are separate upstream projects with their own security channels

Docker Engine
containerd, runc and the kernel primitives BuildKit configures

BuildKit
crabbyavif, the separate Rust implementation Chromium now uses, which shares no code with this tree

libavif
Crash-only one-liners that silence a non-exploitable abort without closing a class of defect

bmcweb
Crashes in a tool the reporter already had the privilege to run, where no user, mount or ownership boundary is actually crossed

util-linux
Cross-site scripting without a CSP bypass, which Elastic assesses case by case and may pay only at low severity, a caveat that bites harder here than anywhere else in the program given how much of Kibana's history is XSS

Kibana
curl's use of libssh2: a defect in how curl drives the library belongs with curl, which has its own entry

libssh2
dbt Cloud, the hosted product, along with Snowflake, Databricks and Fivetran integrations that embed dbt. Those belong to their vendors

dbt-core
Defects in a card's own firmware or applet rather than in OpenSC's handling of it

OpenSC
Defects in a consumer's use of the API rather than in the library's behaviour

libseccomp
Defects in a consuming SAML or document signing implementation rather than in xmlsec itself

xmlsec
Defects in an embedding application rather than in GoBGP's own code

GoBGP
Defects in libxml2 or libxslt rather than in xmlsec, which belong upstream with those projects

xmlsec
Defects in PC/SC-lite, in a reader driver, or in a consuming application rather than in OpenSC

OpenSC
Defects in Traefik or in another consumer rather than in lego itself

go-acme/lego
Defects inside a dependency itself, such as Imath or the underlying compression library. The policy covers coordination for inherited flaws, and the fix belongs upstream

OpenEXR
Defects inside a third-party library Exiv2 links, unless Exiv2's own use of it is what makes them reachable

Exiv2
Defects inside an upstream library such as libjpeg-turbo, zlib or libtiff that Pillow merely calls, unless Pillow's use of it is what makes the defect reachable

Pillow
Defects inside CPython or inside the standalone interpreter builds uv downloads, as opposed to how uv fetches and verifies them

uv
Defects inside the AV1 codecs themselves. libaom, dav1d, libgav1, rav1e and SVT-AV1 are separate projects with their own processes

libavif
Defects inside the codec libraries themselves. A crash in libde265, dav1d, aom or x265 belongs to that project, and libde265 in particular runs its own disclosure process

libheif
Defects that actually live in a linked crypto backend such as OpenSSL, mbedTLS, libgcrypt or WinCNG rather than in libssh2

libssh2
Defects that actually live in Cargo, rustc or crates.io rather than in the plugin, which belong upstream with those projects

CycloneDX Rust Cargo
Defects that actually live in the Linux kernel's namespace, seccomp or cgroup implementation: a kernel privilege escalation reached from inside a jail is a kernel bug rather than an nsjail bug

nsjail
Defects that actually live in the Rust standard library or in a third-party crate rather than in the in-scope repositories

ntpd-rs (Project Pendulum)
Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions

RE2 Guava
Deliberate cluster configuration, such as admitting privileged pods, granting hostPath mounts or disabling seccomp by policy

CRI-O
Deliberate operator choices, such as exposing the daemon socket to a container, running containers privileged or publishing the API on a network without TLS

Docker Engine
Deliberate operator configuration, such as running with delete.enabled on for anonymous users, serving without TLS or leaving the catalog endpoint public on purpose

Distribution
Denial of service against the hosted Dependabot service by volume rather than by defect

Dependabot Core
Denial of service aimed at Cloudflare's production edge, which the program excludes outright

Cloudflare Pingora
Denial of service and distributed denial of service, brute force, spam, social engineering and physical intrusion

NVIDIA Container Toolkit
Denial of service and memory exhaustion driven by large inputs, which the policy places out of scope outright

Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)
Denial of service whose cost is merely linear in the size of the input

Cloudflare Pingora
Denial of service, spamming and social engineering, ruled out by the policy's research conduct rules

Vaultwarden
Dependency CVEs in third-party crates without a demonstrated reachable path through Pingora itself

Cloudflare Pingora
Dependency-confusion reports

Microsoft Agent Framework
Dependency-only CVE reports without a demonstrated chain through this code

Tiered Storage for Apache Kafka
Deployments exposing 3389 to the internet with no TLS and no network controls, which is an operator decision

xrdp
Deployments running with no token or OIDC configured at all, where the server was told to accept anyone

frp
Deprecated components, which are not supported targets

kube-state-metrics Cluster Autoscaler
Deserialisation gadget chains that live in the application's own classpath rather than in Gson

Gson
DevUI and other prototype, experimental or local-testing-only components

Microsoft Agent Framework
Differences between the guava and guava-android artifacts that carry no independent security impact

Guava
Distribution packaging and distro-specific patches

libde265
Distribution packaging and distro-specific patches rather than the upstream tree

OpenEXR
Distribution packaging and distro-specific patches rather than upstream libavif

libavif
Distribution packaging and distro-specific patches rather than upstream libheif

libheif
Distribution packaging and downstream patches

libseccomp
Distribution packaging and downstream patches rather than upstream CRI-O

CRI-O
Distribution packaging and vendor patches rather than the upstream repository

xrdp
Distribution packaging and vendored copies that have drifted from upstream

libass
Distribution patches and packaging rather than upstream Exiv2

Exiv2
Distribution-specific patches and packaging rather than defects in the upstream tree

util-linux
Distribution-specific patches and packaging rather than upstream libpng

libpng
Docker Desktop's proprietary components and the Docker Hub service, which sit outside the moby/moby tree

Docker Engine
Docker Engine itself, which ships as a separate project with its own policy and its own entry here

BuildKit
Documentation-only issues

TypeScript PowerShell
Downstream applications that call Exiv2, including KDE components, digiKam and darktable, which have their own trackers

Exiv2
Downstream consumers that link libmount or libblkid, such as systemd and udisks, which are maintained elsewhere

util-linux
Downstream consumers that link libpng, such as ImageMagick, Qt and GTK, which are maintained elsewhere

libpng
Downstream consumers that link OpenEXR, including OpenCV, Blender and Nuke, and other Academy Software Foundation projects with their own repositories

OpenEXR
Downstream integrations such as GIMP, ImageMagick and libvips

libavif
Downstream integrations such as GIMP, ImageMagick and libvips, which are maintained elsewhere

libheif
Downstream players and integrations rather than the decoder itself

libde265
Downstream servers misconfiguring Brotli content encoding

Brotli
Downstream wrappers and frameworks that call Pillow, including Django's image handling

Pillow
Draft-protocol reference implementations and IETF interop endpoints, which the program calls out as Informational only

CIRCL
Earlier web stacks on .NET Framework, namely ASP.NET Web Forms and ASP.NET MVC

.NET
Embedder mistakes: a host that deliberately handed the guest a capability, or wired a host function that does no validation of its own

Wasmtime
Enforcement of the CAWG X.509 trust model, also recorded as not currently accepted

Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)
Executing a PEP 517 build for a source distribution, ruled out by name; running build code is what installing an sdist means

uv
Exploits that require administrator privilege to begin with, which the policy treats as admin-only and invalid

Rancher
Findings against a third-party network stack or filesystem an integrator substituted for the ones in the tree

Eclipse ThreadX
Findings against an outdated release: the in-scope statement covers the current latest release plus main and testing only

Vaultwarden
Findings against releases and backends outside the published five-year support matrix

xmlsec
Findings against versions where the fix has already shipped, given how frequently this project releases

node-tar
Findings filed as a public GitHub issue, which the policy explicitly redirects away from

Dgraph
Findings in BoringSSL or OpenSSL that AWS-LC has not inherited, which belong with the upstream project

AWS-LC
Findings only reachable in a bespoke proxy an outside developer wrote on top of the framework, with no Cloudflare-reachable path

Cloudflare Pingora
Findings only reproducible on end-of-life or legacy versions of the distribution

Kibana
Findings outside the published security boundary in PROJECT.md

BuildKit
Findings submitted without a working proof of concept

CIRCL
Findings that assume the operator already granted the permission being abused, which is a configuration choice rather than a bypass

Deno
Findings that belong to a separate upstream project nsjail depends on rather than to its own tree, since the Patch Rewards scope row covers this project by repository URL

nsjail
Findings that cannot be argued to CVSS impact on Shopify or its merchants

Shopify identity_cache
Findings that cannot be tied to CVSS impact on Shopify, its merchants, or its partners

Shopify job-iteration
Findings that only reproduce on an unmaintained stock Magento CE build with none of the fork's fixes applied

OpenMage LTS
Findings that presuppose the attacker already controls the machine running the scan

Trivy
Findings whose impact stays on the local machine, since Fluent UI sits outside the carve-out Microsoft grants to VS Code, Agent Framework, TypeScript, Monaco Editor and PowerShell

Fluent UI
Findings with no working proof of concept

Shopify identity_cache
Findings you cannot tie back to the Apache-2.0 cyclonedx-rust-cargo code this program is scoped to

CycloneDX Rust Cargo
Forks and downstream repackagings of the interpreter rather than the upstream repository the OSS-Fuzz integration names

Ruby (CRuby)
Format-support gaps and files libsndfile declines to open

libsndfile
FreeRDP, Remmina or the Microsoft RDP client's own defects, as opposed to xrdp's handling of what they send

xrdp
Gadget classes in third-party libraries. The gadget belongs to that library; the report here is that Jackson's validation failed to stop it

Jackson
Google repositories the tier file does not name, which sit at OT2 or OT3 and pay nothing for a product vulnerability

XNNPACK
Gradle and Maven consumer configuration problems on the integrator's side

Guava
Harbor, the GitLab Container Registry and other products that embed or fork this code, where the defect is in their own additions

Distribution
Hardening or standards-deviation findings with no demonstrated impact

CIRCL
Hosting and server configuration, including a deployment that serves the var or media directory as executable

OpenMage LTS
Image size, layer count and build-time complaints, which carry no security consequence

Distroless
Independent Brotli reimplementations such as brotli-rs or dropbox/rust-brotli, which are not in the tier file

Brotli
Insecure configurations, notably an operator who deliberately allow-listed sensitive labels

kube-state-metrics
Integrator configuration choices, such as building without the module manager's memory protection enabled

Eclipse ThreadX
Intentionally disclosed information, which for this project is most of what it emits

kube-state-metrics
Invoking a system Python interpreter, which the policy states is not a vulnerability in uv

uv
Issues already published as advisories on the repository

libseccomp
Issues in the upstream Apache Kafka broker itself, which belong to the ASF, and the ASF pays nothing for them

Tiered Storage for Apache Kafka
k3s and RKE2 as products, which have their own scope even though the security address is shared

Rancher
Kernel-side seccomp defects, which belong to the Linux kernel security process

libseccomp
Kubernetes on Windows or other non-Linux platforms

Cluster Autoscaler kube-state-metrics
libass publishes no exclusion list. The items below are genuinely another project's code rather than policy text

libass
libssh, which is a different project with a different codebase despite the similar name, and has its own upstream and its own scope row

libssh2
libyuv and other third-party libraries libavif links, unless libavif's own use of them is what makes the defect reachable

libavif
Load or availability testing against a production ACME endpoint

go-acme/lego
Local users with a valid account doing what their account already permits inside their own session

xrdp
Long-superseded releases where the fix has been available for years and the finding is simply that an old version is old

Jackson
Low business criticality prices a finding down by the programme's own stated rule, alongside technical impact and the quality of the documentation you supply, and there is no published ladder to appeal to

swiyu (Swiss e-ID and Trust Infrastructure)
Low-impact CSRF, low-impact server-side information disclosure, and bugs needing extensive or unlikely user interaction

.NET
Magento 1: the legacy asset is marked neither eligible for bounty nor eligible for submission, so a finding there cannot be filed here even for triage

Adobe Commerce Open Source (Magento Open Source)
Magento 2 and Adobe Commerce, which are a different codebase covered by Adobe's own paid programme

OpenMage LTS
Malicious packages published to PyPI, which is registry abuse rather than a uv defect

uv
Malicious-package findings on npm or RubyGems, which are abuse reports to those registries rather than bounty submissions here

Dependabot Core
Memory exhaustion from a large but entirely well-formed file, where the caller ran with limits deliberately disabled

OpenEXR
Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch

XNNPACK
Memory-corruption reports submitted without exact OSS-Fuzz reproduction steps against an existing fuzz target, or a merged upstream patch

RE2
Memory-corruption reports without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch, which the program requires on every OT0 and OT1 repository

Brotli
Merchant configuration and store-level settings chosen deliberately

OpenMage LTS
Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing

TypeScript Fluent UI Microsoft Agent Framework PowerShell
microsoft/semantic-kernel and microsoft/autogen, which the program's own scope text names as separate projects it does not include

Microsoft Agent Framework
Missing HTTP security headers with no demonstrated impact, named as invalid

Rancher
Model output quality, hallucination, and prompt injection treated as jailbreak where no security boundary is actually crossed

Microsoft Agent Framework
Moderate and Low severity, which pay $0 at every report quality

TypeScript Microsoft Agent Framework Fluent UI PowerShell
Network access triggered by C2PA manifest input, which the policy records as not currently accepted while mitigations are in progress

Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)
Node.js core code outside the parser, including undici and the http module, unless the parser is what makes the issue reachable

llhttp
Node.js runtime defects and npm dependency CVEs, unless Haraka's own use of them is what makes the defect reachable

Haraka
Non-default build configurations the policy describes as unsafe, unless the same defect reaches a default build

libde265
Non-Shopify GitHub repositories and forks, which fall outside the org-wide wildcard

Shopify job-iteration
npm's own install logic and the npm registry, which belong to GitHub's paid programme rather than to this library

node-tar
Null-pointer issues, listed as asset-specific out of scope

NVIDIA Container Toolkit
Object storage services themselves rather than the registry's use of them

Distribution
Object-typed deserialisation, which the project documents as unsafe by design

Gson
One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude by name along with resource-exhaustion denial of service

Ruby (CRuby) Deno Wasmtime Joomla
One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, and resource-exhaustion denial of service, which is excluded by name

nsjail
One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, including crashes that come from resource exhaustion

libssh2 PHP
One-liner patches that fix non-exploitable crashes, and denial of service by resource exhaustion, which the rules exclude by name

PrestaShop
OpenShift's own components layered above the runtime

CRI-O
Operating-system clipboard and window-manager behaviour outside kitty's control

kitty
Operator configuration: an open relay someone configured deliberately is a decision rather than a defect

Haraka
Operator decisions such as running a builder privileged, sharing one builder between untrusted tenants without isolation, or mounting the host Docker socket into a build

BuildKit
Operator policy configuration that accepts a prefix it should have filtered

GoBGP
Other HTTP parsers, including the archived nodejs/http-parser that llhttp replaced

llhttp
Other tar implementations. GNU tar, libarchive and the rest are separate targets with separate reporting

node-tar
Other terminals, including VTE-based ones. kitty implements its own core and shares no parser with them

kitty
Out-of-support or end-of-life versions of .NET or ASP.NET Core, plus daily and pre-RTM builds

.NET
Password-guessing and brute-force observations against a correctly functioning pam_unix

Linux-PAM
Patches older than twelve months or newer than one month at the moment of submission, and anything past three submissions per person per month

PrestaShop
Patches over twelve months old, which fall outside the program's age window

bmcweb
Patches the bmcweb maintainers decline, since the reward is contingent on the merge rather than on the idea

bmcweb
Patches the maintainers decline, patches under one month or over twelve months old, and anything past three submissions a person a month

PHP libssh2 nsjail
Patches the PrestaShop maintainers decline, since Google explicitly declines to second-guess a maintainer's decision

PrestaShop
Payment gates that apply across the Adobe program: identity verification before a payout is released, and the stated requirement to "provide your Testing IP address" in order to receive a monetary payout

Adobe Commerce Open Source (Magento Open Source)
Payment gates that apply across the Adobe program: identity verification before a payout is released, and the stated requirement to "provide your Testing IP address" in order to receive a monetary payout where that applies

Adobe C2PA Tool (c2patool / c2pa-rs, Content Authenticity Initiative)
PCRE, RE2J and other regex engines, including ones that advertise RE2-compatible syntax

RE2
Performance regressions and non-security behaviour changes

Guava
Performance regressions and numerical accuracy differences, which are not security issues

XNNPACK
PHP itself and bundled upstream libraries, which have their own separate pathways rather than being defects in Joomla core

Joomla
Physical attacks on a device an attacker already holds, including debug-port readout of flash

Eclipse ThreadX
Pickle deserialization that presupposes the attacker already has write access to the checkpoint storage backend, which Microsoft treats as a trusted channel in the deployment architecture

Microsoft Agent Framework
Platform components not unique to .NET (for example IIS, OpenSSL, and similar dependencies), and third-party dependencies the .NET team does not maintain

.NET
Prometheus, Grafana and the rest of the downstream stack, which are separate projects with no bounty at all

kube-state-metrics
Public CVEs surfaced by a scanner with no demonstrated impact on Rancher, named by the policy as an invalid report type

Rancher
Public disclosure ahead of coordination

BuildKit
Public disclosure ahead of the coordinated release

Distribution
Public disclosure before the agreed embargo lifts

Rancher
Public disclosure before the embargo lifts, which the policy sets automatically

CRI-O
Public GitHub issues for security matters, since the policy asks for the confidential channel instead

Haraka
Public GitHub issues used for an unfixed security defect, when the policy provides a private draft advisory instead

Exiv2
Public GitHub issues used to report an unfixed memory-safety defect, when private reporting is enabled on the repository

libheif
Public GitHub issues used to report an unfixed security defect, which the policy asks you not to do

Pillow
Public GitHub issues used to report an unfixed vulnerability, when the private advisory route is documented at length

OpenEXR
Public issue reports and third-party CNA submissions, both ruled out by the policy

GoBGP
Public issue reports for an unfixed vulnerability, which the policy asks you not to file

libavif
Publicly disclosed issues and anything already reported to Microsoft

.NET
Publicly disclosed issues and dependency-confusion reports

Fluent UI PowerShell
Python interpreter and standard library bugs

Pillow
React and the other third-party packages the library consumes rather than owns

Fluent UI
Read the scope tab yourself once you have an account

ntpd-rs (Project Pendulum)
Releases outside the three most recent, which the Kubernetes program does not treat as supported

Cluster Autoscaler kube-state-metrics
Rendering and appearance defects with no memory-safety or disclosure consequence

libass
Reports against code paths Cloudflare does not run in production and that have no documented production usage

CIRCL
Reports filed as public GitHub issues on aws/aws-lc, since the private advisory channel is disabled and AWS asks for reports through its own intake

AWS-LC
Reports filed as public GitHub issues or posted to the png-mng-implement list, which puts the finding in the open before a fix exists

libpng
Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees

RE2 Guava
Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject

Gson Brotli Distroless
Reports filed publicly on GitHub before coordination, which the policy rules out

Docker Engine
Reports from a maintainer, or from the author or reviewer of the vulnerable code, which the program cannot award

Cluster Autoscaler
Reports from anyone unable to complete the platform's identity verification, which YesWeHack records as required on this program, or unwilling to hold an account at all, since the program cannot be seen without one

ntpd-rs (Project Pendulum)
Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award

PowerShell Fluent UI Microsoft Agent Framework TypeScript
Reports that merely state software is out of date or vulnerable without a proof of concept

NVIDIA Container Toolkit
Reports that only demonstrate impact with a Super User account already in hand, since that role is inside the trust boundary by design

Joomla
Reports with no functional proof of concept, which the program closes rather than triages

Shopify job-iteration
Reports without a working proof of concept, which the policy will not process

Rancher
Repositories in Google's GitHub orgs that the tier file does not list, which pay nothing for a product vulnerability after the April 2026 rules update

RE2 Guava
Repositories outside the Shopify organisation, plus forks and archived repositories, none of which the wildcard covers

Shopify identity_cache
Repositories the tier file does not name, and images that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward

Distroless
Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward

Gson Brotli
Resource exhaustion from an expensive traversal or a large mutation, which is a capacity question

Dgraph
Resource exhaustion from raw connection volume against a server with no limits configured

frp
Reverse proxies and front ends as products; the disagreement between them and llhttp is in scope on the parser's side

llhttp
Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue

RE2 Guava
Route hijacking by a peer sending what it is configured and authorised to send, which is BGP behaving as specified

GoBGP
RubyGems, Rack and the wider gem ecosystem, which this study records as separate projects with no paid pathway of their own

Ruby (CRuby)
Ruff and Astral's other projects, which share the same security address but are separate codebases

uv
runc and crun themselves, where the defect is in the runtime rather than in the spec CRI-O generates or the way it invokes them

CRI-O
Samples, tutorials and quickstart code

Fluent UI PowerShell
Samples, tutorials, quickstart code and anything under samples/

TypeScript
Samples, tutorials, quickstart code and samples/ directories

Microsoft Agent Framework
Scanner false positives about packages present in the image, without a demonstrated impact

Distroless
Self-inflicted misconfiguration, also named as invalid

Rancher
Severity cap to plan around: the org-wide open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org

CIRCL
Severity cap to plan around: the Tier 2 open-source row tops out at $3,500 for a Critical, since Cloudflare's $10,000 row is bound to production infrastructure rather than the GitHub org

Cloudflare Pingora
Silicon vendor SDK forks. ST, Renesas, NXP and Microchip ship their own integrations, and a defect that exists only there belongs to that vendor

Eclipse ThreadX
Site-specific misconfiguration: a permission an administrator granted, or an ACL set up more broadly than intended

Joomla
Software that no longer receives security updates, and issues NVIDIA already knew about from its own testing, which are flagged as duplicates

NVIDIA Container Toolkit
Static-analysis-only reports pointing at unsafe blocks with no runnable reproduction

Cloudflare Pingora
Submissions from outside the Bug Bounty Switzerland platform, which is the only channel the programme runs on, and KYC is required before a payout is released

swiyu (Swiss e-ID and Trust Infrastructure)
Supply-chain findings against Elastic's build and release tooling, which are paid on the separate Software Supply Chain row rather than as a Kibana finding

Kibana
Syntax incompatibilities with PCRE that carry no security impact

RE2
Testing carried out against live merchant storefronts or Adobe-operated environments, when the test plan permits testing only against your own local installations

Adobe Commerce Open Source (Magento Open Source)
The absence of authentication on /metrics as a finding in itself, since that is the documented deployment model. A report has to show something reaching the endpoint that was never meant to be there

kube-state-metrics
The ACME server side and CA policy, which belong with the CA operating it

go-acme/lego
The C reference implementation and chrony, which are separate projects with separate maintainers and, in the reference implementation's case, a separate program entirely

ntpd-rs (Project Pendulum)
The CycloneDX specification itself, and the sibling CycloneDX implementations for other ecosystems, which are separate projects with their own repositories

CycloneDX Rust Cargo
The documentation site and Storybook demos

Fluent UI
The experimental encoder, ruled out by name in the policy

libde265
The external token auth service in a token-auth deployment, where that service is a separate implementation

Distribution
The full/classic .NET Framework, which is explicitly out of scope

.NET
The Go runtime and standard library, unless GoBGP's use of them is what makes the issue reachable

GoBGP
The Kubernetes control plane and kubelet, which belong to the Kubernetes program and carry their own scope

CRI-O
The Linux kernel primitives CRI-O configures

CRI-O
The Linux kernel primitives the daemon configures, where the defect is in the kernel rather than in what Docker asked for

Docker Engine
The medium-severity cap on this asset: the $50,000 and $200,000 cells cannot be reached from a source-code finding however it scores

Shopify job-iteration Shopify identity_cache
The original PIL, which is unmaintained and is a different codebase

Pillow
The policy publishes no exclusions list, so what follows is ordinary out-of-scope territory rather than a stated policy position

Haraka
The project publishes no exclusion list, so the items above are genuine boundaries rather than policy text

libsndfile
The registries, container runtimes and cloud APIs Trivy talks to

Trivy
The rest of the OpenBMC distribution, meaning the Yocto layers and the phosphor-* daemons, unless separately integrated into OSS-Fuzz, since projects/openbmc does not exist

bmcweb
The roughly 30 per-cloud provider implementations in the same repository, which the program treats as vendor-specific plugins and does not pay for

Cluster Autoscaler
The Rust png crate Chrome now uses. Different codebase, different project, no relationship to this tree

libpng
The sample and demo applications shipped with the source, also ruled out by name

libde265
The security of the service on the far end of the tunnel, as opposed to frp's handling of the traffic

frp
The shell or the program that emitted the sequence; kitty displaying hostile output is a bug only where kitty mishandles it

kitty
The web-vault and Bitwarden's mobile and desktop clients: the policy sends these to github.com/bitwarden, which Vaultwarden is explicitly not associated with

Vaultwarden
The X server and desktop environment behind the session rather than xrdp and xorgxrdp

xrdp
Theoretical findings with no proof of concept

Tiered Storage for Apache Kafka
Theoretical issues with no realistic exploit scenario, and anything requiring complex end-user interaction to reach

NVIDIA Container Toolkit
Theoretical weaknesses in a standardised algorithm rather than a defect in this implementation of it

AWS-LC
Third-party charts and extensions that Rancher neither maintains nor ships by default

Rancher
Third-party components and services, which fall outside the policy even where Kibana bundles them

Kibana
Third-party extensions and marketplace modules, which are not part of the shipped Commerce editions the asset row names

Adobe Commerce Open Source (Magento Open Source)
Third-party extensions, templates and plugins from the Joomla Extensions Directory, which are separate projects and are not the repository Google's Tier 1 row names

Joomla
Third-party forks and the many rebranded frp derivatives rather than the upstream repository

frp
Third-party frontends and downstream builders, where the defect is theirs rather than in the interface BuildKit exposes

BuildKit
Third-party JSON libraries, including other parsers an application happens to use alongside Gson

Gson
Third-party Magento 1 extensions and themes maintained outside the OpenMage tree

OpenMage LTS
Third-party modules and themes, which are not the repository named in the Tier 1 scope row and are maintained by their own authors

PrestaShop
Third-party modules from the PowerShell Gallery that Microsoft does not own

PowerShell
Third-party npm modules, which belong to the separate ecosystem programme

llhttp
Third-party PAM modules that are not in this repository, including vendor SSO modules, pam_mount, and the long tail of out-of-tree modules

Linux-PAM
Third-party PECL extensions that are not carried in the php-src tree

PHP
Third-party plugins that are not part of the engine

Docker Engine
Third-party plugins written outside the Haraka organisation

Haraka
Third-party Trivy plugins that are not maintained in the project

Trivy
Third-party TypeScript-adjacent packages that Microsoft does not own, including language-service plugins and community @types definitions

TypeScript
Time-source trust decisions the operator made deliberately, such as running unauthenticated NTP where NTS was available. That is configuration rather than a defect

ntpd-rs (Project Pendulum)
Timing observations presented on their own, without a demonstrated recovery of key material or other security consequence

CIRCL
Training material, community forums, and non-product sample or community sites (outside the in-scope docs/samples category)

.NET
Type-system unsoundness with no security impact, which the project treats as designed behaviour rather than a defect

TypeScript
Unpayable without KYC: the platform verifies identity before releasing money, so the account you file under has to be verifiable in your own name

CycloneDX Rust Cargo
Upstream Debian package CVEs that distroless merely repackages, which belong with the upstream package maintainers

Distroless
Upstream dependencies and distribution packaging rather than the upstream kitty tree

kitty
Upstream dependency vulnerabilities, unless Jackson's own use of the dependency is what makes them reachable

Jackson
Upstream dependency vulnerabilities, unless Vaultwarden's own use of the dependency is what makes it reachable

Vaultwarden
Upstream Go library defects, unless frp's own use of the library is what makes them reachable

frp
Upstream Jinja2, agate or Python dependency bugs, unless dbt's own use of the dependency is what makes them reachable

dbt-core
Upstream Kubernetes defects that Rancher only inherits

Rancher
Upstream libraries and third-party services the federal repositories depend on, which belong to their own projects rather than to this programme

swiyu (Swiss e-ID and Trust Infrastructure)
Upstream PHP library issues, unless OpenMage's own use of the library is what makes the defect reachable

OpenMage LTS
V8 itself, which is a separate project already carrying its own funded programme

Deno
Vendor BMC forks, which is the practical limitation here: most shipped BMCs are AMI MegaRAC or a vendor derivative rather than upstream bmcweb

bmcweb
Volumetric denial of service, described by the policy as 'network flooding, request flooding, port flooding, required traffic volume scaling with deployment size', which is never eligible

Kibana
Volumetric denial of service. A single crafted session that pins a worker is the interesting case; sending a million messages is not

Haraka
Vulnerabilities in applications and frameworks written in PHP such as WordPress, Drupal and Laravel, rather than in php-src; those have their own programmes

PHP
Vulnerabilities in Memcached itself, which is a separate project running no bounty at all

Shopify identity_cache
Vulnerabilities in the application a user layers on top of a distroless base image

Distroless
Vulnerabilities in the upstream package managers themselves rather than in dependabot-core, a boundary the scope line draws firmly

Dependabot Core
Vulnerabilities in Trivy's own dependencies, which the policy routes to GitHub Discussions rather than to the private channel

Trivy
Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail

bmcweb
Wasmer, WasmEdge and other WebAssembly runtimes, which are separate projects with their own repositories and their own pathways

Wasmtime
Weak local policy an administrator configured deliberately, such as a permissive pam_access rule or a disabled password quality check

Linux-PAM
Weaknesses in a standardised algorithm rather than in this implementation of it

OpenSC
Weaknesses in the underlying libcrypto rather than in s2n-tls's use of it; those belong with AWS-LC, OpenSSL or whichever backend is linked

s2n-tls
Weaknesses in the XML Signature specification itself rather than in this implementation of it, unless xmlsec has a safer option it fails to apply

xmlsec
Web server or FPM pool misconfiguration rather than a defect in the interpreter

PHP
Whatever Adobe's own written exclusions cover: read the program's policy and scope page in full before assuming a bug class qualifies

Adobe Commerce Open Source (Magento Open Source)
Windows PowerShell 5.1 and the inbox Windows component, which belong to Windows servicing

PowerShell
Wrong or missing data in the upstream advisory feeds Trivy consumes; a bad record in an upstream source is not a Trivy defect

Trivy
Zero-days in in-scope assets reported within 14 days of a patch or mitigation going public, which may be filed but are usually not bounty-eligible

NVIDIA Container Toolkit
zlib defects, unless libpng's own use of zlib is what makes them reachable

libpng

Recent changes

Reward and scope changes across every Microsoft program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Microsoft products, from the NVD.

Search NVD

CVE-2026-124194 Medium

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-124194 Medium

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-124194 Medium

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-124194 Medium

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-124194 Medium

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-121162 Medium

UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121162 Medium

UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121162 Medium

UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

About this page

This page gathers every public program listed under microsoft.com and the companies Microsoft owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Microsoft.

Something wrong or missing? Report a correction.