Proton bug bounty programs
proton.me Updated
Proton runs two public programs: a self-hosted bug bounty paying up to $100,000 and a Sorona bug bounty paying up to $51,000.
- Top reward
- $100,000
- Self-hosted
- Programs
- 2
- 2 pay cash
- Targets in scope
- 47
- 6 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Proton
Self-hosted · Pays the most of the 2 programs: up to $100,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Proton
Self-hosted · Bug bounty |
$50k | $25k | $2,500 | – | $100,000 | Full | – | – | Open |
|
Proton (Mail, VPN, Pass, Drive, Bridge clients)
Sorona · Bug bounty |
$51k (highest) | $26k (highest) | $3,125 (highest) | – | $51,000 | Partial | – | – | Open |
-
- Critical
- $50k
- High
- $25k
- Medium
- $2,500
- Low
- –
- Safe harbor
- Full
-
- Critical
- $51k (highest)
- High
- $26k (highest)
- Medium
- $3,125 (highest)
- Low
- –
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
47 targets across all 2 programs, each listed once with the programs that cover it. 12 excluded.
-
Proton VPN web extensions (Android TV, Apple TV, Chrome, Chromebook, and Firefox)
Android
Covered by Self-hosted
-
The SimpleLogin browser extensions (Chrome, Edge, Firefox, and Safari)
Desktop and binaries
Covered by Self-hosted
-
Proton Authenticator desktop apps (Linux, macOS, and Windows)
Products and areas
Covered by Self-hosted
-
Proton's published qualifying-vulnerability list, organised by surface rather than by repository, naming four: web applications, desktop applications, mobile applications and servers. All four are in scope; the client surfaces are the ones with source to read, GPL-3.0 on GitHub
Products and areas
Covered by Sorona
-
Proton's servers, which the published list names as the fourth surface even though that code is proprietary and there is nothing to read
Products and areas
Covered by Sorona
-
The cryptography the clients share: key generation, storage and exchange, message and file encryption, address and key verification, and the code that decides what is encrypted before anything leaves the device
Products and areas
Covered by Sorona
-
The desktop clients and Proton Bridge, including the local IMAP and SMTP server Bridge runs for third-party mail apps and the credentials it holds in order to do that
Products and areas
Covered by Sorona
-
The mobile applications for Mail, VPN, Pass and Drive on iOS and Android, together with their local storage and keychain use
Products and areas
Covered by Sorona
-
The VPN clients across platforms: tunnel and configuration handling, kill-switch and leak behaviour, and the credential storage underneath them
Products and areas
Covered by Sorona
-
The web applications behind the products, which is the ProtonMail/WebClients codebase: Mail, Calendar, Drive, Pass and the account and authentication front end
Products and areas
Covered by Sorona
-
Update and code-signing paths in the desktop clients and Bridge, plus the local privilege boundary each of them sits on, both named in the qualifying list
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 12
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
help.protonmail.com
Self-hosted
-
localize.proton.me
Self-hosted
-
partners.proton.me
Self-hosted
-
protonmail.zendesk.com
Self-hosted
-
shop.proton.me
Self-hosted
-
status.proton.me
Self-hosted
-
support.protonmail.com
Self-hosted
-
Anything outside the four published surfaces: web applications, desktop applications, mobile applications and servers
Sorona
-
Low-severity findings, which the program states carry no monetary reward by default and are handled case by case
Sorona
-
Proton's semi-private incubator scope on Bug Bounty Switzerland, a separate program with its own terms rather than part of this public one
Sorona
-
Publication before Proton has confirmed the fix and agreed the timing with you
Sorona
-
Upstream libraries the clients depend on rather than the client code Proton itself ships, which belong to the projects that publish them
Sorona
Recent changes
Reward and scope changes across every Proton program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Proton products, from the NVD.
-
CVE-2022-50917 High
ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated privileges during service startup.
-
CVE-2022-50917 High
ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated privileges during service startup.
-
CVE-2024-37391 High
ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss.
-
CVE-2024-37391 High
ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss.
-
CVE-2006-3293 Medium
parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages.
-
CVE-2006-3293 Medium
parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages.
About this page
This page gathers every public program listed under proton.me: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.