Apple Bug Bounty Payouts: Are They Too Low?

Apple’s bug bounty program pays security researchers for finding vulnerabilities in its software, but many researchers argue the payouts are too low compared to other platforms and the effort required. This article explains how Apple’s program works, what it pays, why researchers complain, and how it compares to competitors—so you can decide if it’s worth your time.

How Apple’s Bug Bounty Program Works

Apple launched its public bug bounty program in 2016, initially covering iOS only. Over the years it expanded to include macOS, watchOS, tvOS, iCloud, and even the Apple Security Bounty for hardware and software. The program is invite-only for some categories, but anyone can submit via the Apple Security Research website. You report a vulnerability, Apple triages it, and if confirmed, you get a payout based on the severity and type of bug.

Payouts are not fixed; Apple negotiates based on the impact. For example, a zero-click kernel code execution could earn up to $500,000, while a lock screen bypass might get $25,000. However, the actual amounts are often lower because Apple factors in the quality of the report and whether the bug is already known.

Typical Payout Amounts and Tiers

Apple publishes a payout table on its Security Bounty page, but it’s not exhaustive. The table lists categories like:

• Kernel code execution (zero-click): up to $500,000
• Web content sandbox escape: up to $250,000
• Lock screen bypass: up to $25,000
• User data access via iCloud: up to $50,000
• Processing malicious web content: up to $100,000

These are maximums, not guarantees. Many researchers report receiving offers far below the listed cap, especially for bugs that require physical access or are not “zero-click.�

Why Researchers Say Payouts Are Too Low

The main complaint is that Apple’s payouts do not reflect the effort and skill required to find truly impactful bugs. For example, a chain of vulnerabilities that starts with a Safari bug and escalates to full kernel control might take months to develop. Apple might pay $100,000 for that, while a similar chain on a platform like Zerodium could fetch $2 million. Even though Zerodium is a broker that resells exploits, the comparison shows how undervalued Apple’s rewards are for top-tier research.

Another issue is that Apple often rejects reports that are duplicates or deemed “low quality,� even if they contain useful information. Some researchers have publicly shared experiences of spending weeks on a bug only to receive a “not eligible� response. This discourages people from investing time in Apple’s program.

Comparison with Other Bug Bounty Platforms

To understand if Apple is underpaying, look at what other companies offer:

• Google’s Chrome Vulnerability Reward Program pays up to $250,000 for a full exploit chain, and Android pays up to $500,000 for a remote exploit.
• Microsoft’s Bounty Program pays up to $250,000 for critical vulnerabilities in cloud services.
• Zerodium, a private exploit broker, publicly lists prices: $2,500,000 for a full iOS zero-click chain, $2,000,000 for a one-click chain.

Apple’s maximum of $500,000 for a zero-click kernel bug is half of what Zerodium pays for the same type of exploit. While Apple’s program is not a broker, the comparison highlights that the market value of these bugs is much higher than Apple’s cap.

Common Problems Researchers Face

Beyond low payouts, researchers report several frustrations:

• Slow response times: It can take weeks or months to get a response, and even longer to receive payment.
• Vague rejection reasons: Apple sometimes rejects a report without explaining why, leaving the researcher in the dark.
• Negotiation pressure: Apple may offer a lower amount than expected, and researchers feel pressured to accept because they’ve already spent time.
• No public recognition: Unlike some programs that acknowledge researchers publicly (with permission), Apple keeps most reports confidential, which reduces reputation-building opportunities.

These issues make the program less attractive, especially for independent researchers who rely on bounties as income.

How to Choose Where to Report a Bug

If you find an Apple vulnerability, you have options. Here’s how to decide:

1. Assess the bug’s impact: If it’s a critical zero-click remote exploit, consider selling to a broker like Zerodium for maximum payout, but be aware of ethical and legal implications.
2. Check Apple’s eligibility: Read Apple’s Security Bounty documentation to see if your bug type is covered and what the maximum is.
3. Consider responsible disclosure: If you want to help Apple improve security and don’t care about maximum profit, report to Apple directly.
4. Compare with other programs: If the same bug affects multiple platforms (e.g., a webkit bug that also affects Safari on iOS), you might report to Apple and also to the upstream project if applicable.

Remember that selling to brokers may involve signing NDAs and giving up rights, and it might not be legal in your jurisdiction. Always check laws and your employer’s policies if you are a professional researcher.

Frequently Asked Questions

Does Apple pay more for hardware vulnerabilities?

Yes, Apple has a separate “Apple Security Bounty� for hardware, but payouts are similar in range. For example, a physical attack that extracts data from Secure Enclave could earn up to $250,000. However, these bugs are extremely rare and require deep knowledge of hardware.

Can I negotiate a higher payout with Apple?

You can try, but Apple’s team has the final say. They might increase the offer if you provide additional details or demonstrate a higher impact, but there is no guarantee. Some researchers have successfully negotiated, but many have not.

Are bug bounty payouts taxable?

Yes, in most countries, bug bounty payments are considered income and are taxable. You should report them on your tax return. The exact treatment varies by country, so consult a tax professional.

What happens if I find a bug that’s already known?

If Apple already knows about the bug, your report will be marked as a duplicate and you will receive no payment. That’s why it’s important to check if the bug has been publicly disclosed before submitting.

Is it worth reporting low-severity bugs to Apple?

Low-severity bugs may still earn a small bounty or even a “hall of fame� mention, but the payout is often not worth the time. Apple focuses on high-impact vulnerabilities, so spending time on minor bugs might not be cost-effective.

Bottom Line: Are Apple’s Payouts Too Low?

Yes, for many researchers, Apple’s payouts are lower than the market value of the bugs they find, especially when compared to brokers like Zerodium. However, Apple’s program also offers benefits like working directly with Apple’s security team and the satisfaction of improving security for millions of users. If you are a hobbyist or a professional looking for steady income, you might find better rewards elsewhere. But if you want to make a difference and don’t mind the lower pay, Apple’s program is still a valid option.

Related

• Recover Galaxy S9 Data Files: Full Guide
• FileZilla Upload Files to Server: Step-by-Step
• Due Diligence for Buying a Family Food Business