- Top reward
- $100,000
- Top severity paid
- Critical
- Assets in scope
- 39
- Public CVEs
- 3
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $100,000
- for critical bugs, from $1,000.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$50,000 from $25,000 |
| High |
|
$25,000 from $2,500 |
| Medium |
|
$2,500 from $1,000 |
- Top reward
-
$100,000
Maximum reward: USD 100,000
- Lowest reward
-
$1,000
Medium severity: USD 1,000 - USD 2,500
- Safe harbor
-
Full
Our safe harbor policy explains what tests and actions are protected from liability when you report vulnerabilities to the Proton Bug Bounty Program
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
39 assets you may test, 7 excluded.
Domains 15
- account.proton.me
- account.protonvpn.com
- app.simplelogin.io
- app.standardnotes.com
- calendar.proton.me
- docs.proton.me
- drive.proton.me
- lumo.proton.me
- mail.proton.me
- pass.proton.me
- proton.me
- protonvpn.com
- simplelogin.io
- standardnotes.com
- wallet.proton.me
Android apps 11
- Proton Authenticator mobile apps (Android, iOS/iPad)
- Proton Calendar apps (Android and iOS/iPad)
- Proton Drive apps (Android, iOS/iPad [in beta], and Windows)
- Proton Lumo apps (Android, iOS)
- Proton Mail mobile apps (Android and iOS/iPad)
- Proton Pass mobile apps (Android, iOS/iPad)
- Proton VPN apps (Android, iOS/iPad, Linux, macOS, and Windows)
- Proton VPN web extensions (Android TV, Apple TV, Chrome, Chromebook, and Firefox)
- Proton Wallet apps (Android, iOS)
- Standard Notes apps (Android, iOS/iPad, Linux, macOS, and Windows)
- The SimpleLogin mobile apps (Android and iOS)
APIs 2
- api.protonmail.ch
- api.protonvpn.ch
Desktop and binaries 1
- The SimpleLogin browser extensions (Chrome, Edge, Firefox, and Safari)
Products and areas 10
- Desktop applications
- Mobile applications
- Proton Authenticator desktop apps (Linux, macOS, and Windows)
- Proton Bridge apps (GNU/Linux, macOS, and Windows)
- Proton Pass desktop apps (Linux, macOS, and Windows)
- Proton Pass web extensions (Chrome and Firefox)
- Proton Scribe
- Proton Wallet
- Servers
- Web applications
Out of scope (7)
- help.protonmail.com
- localize.proton.me
- partners.proton.me
- protonmail.zendesk.com
- shop.proton.me
- status.proton.me
- support.protonmail.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Proton's policy. "We" in these lines means the program, not this site.
While testing
-
Please contact us if you are unsure if a specific test method is inconsistent with or unaddressed by this policy before you begin testing.
-
If you don’t use Proton Mail, we encourage you to encrypt your submissions using our PGP public key .
Not accepted
-
Findings that describe intended behavior, theoretical or best-practice recommendations without a concrete path to exploitation are ineligible.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2022-50917 | ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated privileges during service startup. | High 8.5 | 13 Jan 2026 |
| CVE-2024-37391 | ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss. | High 7.8 | 22 Jul 2024 |
| CVE-2006-3293 | parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages. | Medium 5.0 | 29 Jun 2006 |