WebKit bug bounty programs

WebKit programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Top reward	Safe harbor	KYC	First response	Status
WE WebKit Sorona · Bug bounty	$300,000	Partial	–	–	Open
JA JavaScriptCore Sorona · Bug bounty	$10,000	Partial	–	–	Open

• WE

  WebKit

  Sorona · Bug bounty

  Open

  Top reward

  $300k

  Safe harbor

  Partial

• JA

  JavaScriptCore

  Sorona · Bug bounty

  Open

  Top reward

  $10k

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://webkit.org

  Web

  Covered by WebKit

• https://webkit.org/blog

  Web

  Covered by JavaScriptCore

• Apple's declaration is outcome-based: the Security Bounty covers research across all Apple products and public-facing services, and the JavaScript engine running inside Safari's WebContent process is Source/JavaScriptCore in the open WebKit tree. A defect anywhere in that engine that a shipping Apple platform reaches is covered, priced at the Web Content code execution row of $10,000

  Products and areas

  Covered by JavaScriptCore

• Apple's declaration is outcome-based: the Security Bounty covers research across all Apple products and public-facing services, and the WebContent process on a shipping Apple device is WebKit. A bug anywhere in the github.com/WebKit/WebKit tree that Safari reaches on a shipped platform is covered. Apple pays for the effect on the platform rather than for the commit

  Products and areas

  Covered by WebKit

• Graphics and media: WebGL and WebGPU, canvas, the media pipeline, image decoders and font handling, including the copies bundled inside the tree

  Products and areas

  Covered by WebKit

• JavaScriptCore, in the same repository under Source/JavaScriptCore and covered by the same Apple programme. It is listed separately on this site because its reachable ceiling is different

  Products and areas

  Covered by WebKit

• The builtins and the standard library the engine implements: Array, Object, Proxy and Reflect, Map and Set, Date, Intl, Promises and the microtask queue, and module loading

  Products and areas

  Covered by JavaScriptCore

• The embedder surfaces Apple ships on top of the engine: the JavaScriptCore C and Objective-C APIs in JavaScriptCore.framework, and the engine as it executes inside WKWebView

  Products and areas

  Covered by JavaScriptCore

• The full compilation pipeline as it ships: the parser and bytecode generator, the LLInt interpreter, the Baseline compiler, and the DFG and FTL/B3 optimising tiers

  Products and areas

  Covered by JavaScriptCore

• The loader and networking layer: URL parsing, resource loading, redirect handling, CORS, Content Security Policy, cookies and the cache, together with the security-origin checks the loader and the DOM both rely on

  Products and areas

  Covered by WebKit

• The Riptide garbage collector and the allocators beneath it, including finalisation and the weak-reference machinery

  Products and areas

  Covered by JavaScriptCore

• The runtime and object model: structures and structure IDs, property storage, inline caches and prototype chains, together with the gigacage and Structure ID randomisation mitigations that harden them

  Products and areas

  Covered by JavaScriptCore

• The web platform features Safari ships: Service Workers, WebAssembly, IndexedDB and the other storage APIs, WebRTC, Web Crypto and Web Push

  Products and areas

  Covered by WebKit

• The WebKit API surface Apple ships to app developers, WKWebView above all, which renders web content inside effectively every iOS app that shows a page

  Products and areas

  Covered by WebKit

• The WebKit2 process architecture: the WebContent process sandbox, the multi-process IPC boundary, and the Networking and GPU process boundaries this tree defines

  Products and areas

  Covered by WebKit

• The YARR regular-expression engine and the WebAssembly path, covering module parsing, validation and the BBQ and OMG compilation tiers

  Products and areas

  Covered by JavaScriptCore

• Typed arrays, ArrayBuffer and SharedArrayBuffer, DataView, and the JSON parser and serialiser

  Products and areas

  Covered by JavaScriptCore

• WebCore in full: the DOM, CSS and layout, rendering and compositing, SVG, editing and selection, and the HTML and XML parsers

  Products and areas

  Covered by WebKit

No target matches. Try part of a host name, such as the company name.