Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Tesla bug bounty programs

tesla.com Updated

Tesla runs one public program: a Bugcrowd bug bounty paying up to $100,000.

Top reward
$100,000
Bugcrowd
Programs
1
1 pays cash
Targets in scope
11
5 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Tesla runs.

  • Tesla

    Bugcrowd · Bug bounty

    Open

    Top reward

    $100k
    Critical
    $100k
    High
    $50k
    Medium
    $20k
    Low
    $10k
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 14 excluded.

  • *.solarcity.com

    Wildcards

  • *.tesla.cn

    Wildcards

  • *.tesla.com

    Wildcards

  • *.tesla.services

    Wildcards

  • *.teslainsuranceservices.com

    Wildcards

  • *.teslamotors.com

    Wildcards

  • Any host verified to be owned by Tesla Motors Inc. (domains/IP space/etc.)

    Web

  • https://play.google.com/store/apps/details?id=com.teslamotors.tesla&hl=en_US&gl=US

    Android

  • https://apps.apple.com/us/app/tesla/id582007913

    iOS

  • Tesla Energy hardware you own

    Hardware and IoT

  • Tesla vehicle hardware that you own

    Hardware and IoT

No target matches. Try part of a host name, such as the company name.

Out of scope 14

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.engage.tesla.com

  • service.tesla.cn/docs/*

  • service.tesla.com/docs/*

  • Any domains from acquisitions, such as maxwell.com

  • Any other third-party websites hosted by non-Tesla entities

  • employeefeedback.tesla.com

  • energysupport.tesla.com (you can report vulnerabilities to bugbounty.zoho.com)

  • feedback.tesla.com

  • feedback.teslamotors.com

  • https://engage.tesla.com

  • ir.tesla.com

  • ir.teslamotors.com

  • mkto.teslamotors.com

  • shop.eu.teslamotors.com

Recent changes

Reward and scope changes across every Tesla program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Tesla products, from the NVD.

Search NVD
  • CVE-2025-8320 High

    Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the HTTP Content-Length header. The issue resul

  • CVE-2025-8321 Medium

    Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware upgrade feature. The issue results from the lack of an anti-downgrade mechanism. An attacker can l

  • CVE-2025-2082 High

    Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the VCSEC module. By manipulating the certificate response sent from the Tire Pressure Monitoring System (TPMS), an a

  • CVE-2024-13943 High

    Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected affected Tesla Model S vehicles. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the QCMAP_Connection

  • CVE-2024-6029 Medium

    Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris modem in affected Tesla Model S vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firewall service. The issue results from a failure to obtain the xtables lock. An attacker can levera

  • CVE-2024-6030 High

    Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code within the sandbox on the target system in order to exploit this vulnerability. The specific flaw exists within the oFono process. The process allows an attacker to modi

  • CVE-2024-6031 High

    Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT commands. The issue resul

  • CVE-2024-6032 High

    Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target system in order to exploit this vulnerability. The specific flaw exists within the ql_atfwd process. The issue results from the lack of proper

About this page

This page gathers every public program listed under tesla.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.