Did you know Apple has an open bug bounty program on any of its latest publicly available versions of iOS, iPad, macOS, tvOS, and watchOS? The company promises researchers who find and clearly report issues to Apple Product Security a lucrative payout.

Depending on the bug discovered, the program has payouts ranging from Sh10.7 million ($100,000) to Sh160 million ($1.5 million) on its different bounty categories such as bugs in iCloud, device attacks via physical access, network access with user interaction among others.

The instructions are strict where a full chain exploit will have to be submitted with the report. was announced back in a Black Hat conference a few years ago and has now been open since 2019.

Google and  Facebook also have also bounty rewards for researchers and hackers to put their security practices under the microscope. Microsoft, Yahoo, Chrysler, and United Airlines have also had bug bounties.


In order to be eligible for an Apple Security Bounty, the issue must occur on the latest publicly available versions of iOS, iPadOS, macOS, tvOS, or watchOS with a standard configuration and, where relevant, on the latest publicly available hardware or the Security Research Device. These eligibility rules are meant to protect customers until an update is available, ensure Apple can quickly verify reports and create necessary updates, and properly reward those doing original research. Researchers must:

  • Be the first party to report the issue to Apple Product Security.
  • Provide a clear report, which includes a working exploit (detailed below).
  • Not disclose the issue publicly before Apple releases the security advisory for the report. (Generally, the advisory is released along with the associated update to resolve the issue).

Issues that are unknown to Apple and are unique to designated developer betas and public betas, including regressions, can result in a 50pc bonus payment. Qualifying issues include:

  • Security issues introduced in certain designated developer beta or public beta releases, as noted in their release notes. Not all developers or public betas are eligible for this additional bonus.
  • Regressions of previously resolved issues, including those with published advisories, that have been reintroduced in certain designated developer beta or public beta release, as noted in their release notes.

Bounty Categories

Bounty payments are determined by the level of access or execution achieved by the reported issue, modified by the quality of the report. A maximum amount is set for each category.

The exact payment amounts are determined after reviewing by Apple. All security issues with significant impact on users will be considered for Apple Security Bounty payment, even if they do not fit the published bounty categories. Apple Security Bounty payments are at Apple’s discretion.

AlSO READ:  Hackers Release A New Jailbreak Working On Any iPhone
Topic Maximum Payout
iCloud Unauthorized access to iCloud account data on Apple Servers $100,000
Device attack via physical access Lock screen bypass $100,000
User data extraction $250,000
Device attack via user-installed app Unauthorized access to sensitive data** $100,000
Kernel code execution $150,000
CPU side-channel attack $250,000
Network attack with user interaction One-click unauthorized access to sensitive data** $150,000
One-click kernel code execution $250,000
Network attack without user interaction Zero-click radio to kernel with physical proximity $250,000
Zero-click unauthorized access to sensitive data** $500,000
Zero-click kernel code execution with persistence and kernel PAC bypass $1,000,000

View a detailed list of example payouts

Report and Payout Guidelines

The goal of the Apple Security Bounty is to protect customers through understanding both vulnerabilities and their exploitation techniques. Reports that include a basic proof of concept instead of a working exploit are eligible to receive no more than 50% of the maximum payout amount. Reports lacking the necessary information to enable Apple to efficiently reproduce the issue will result in a significantly reduced bounty payment if accepted at all.

A complete report includes:

  • A detailed description of the issues being reported.
  • Any prerequisites and steps to get the system to an impacted state.
  • A reasonably reliable exploit for the issue being reported.
  • Enough information for Apple to be able to reasonably reproduce the issue.

Maximizing Your Payout

To maximize your payout, keep in mind that Apple is particularly interested in issues that:

  • Affect multiple platforms.
  • Impact the latest publicly available hardware and software.
  • Are unique to newly added features or code in designated developer betas or public betas, including regressions, as noted on this page when available.
  • Impact sensitive components.
  • Are novel.

Additional Requirements

In addition to a complete report, issues that require the execution of multiple exploits, as well as one-click and zero-click issues, require a full chain for maximum payout. The chain and report must include:

  • Both compiled and source versions.
  • Everything needed to execute the chain.
  • A sample non-destructive payload, if needed.

Sending Your Report

Send your report by email to [email protected]. Whenever possible, encrypt all communications with the Apple Product Security PGP Key. Include all relevant videos, crash logs, and system diagnosis reports in your email. If necessary, use Mail Drop to send large files.

Follow Techspace Africa on Facebook and Twitter. For the latest news, tech news, breaking news headlines, reviews and live updates check out tech-space.africa

Nigel Jr.
As a tech enthusiast and expert, Nigel Jr. is dedicated to providing in-depth and insightful content on all things technology. With a background in online journalism, product reviewing, and tech creation, Nigel has become a trusted source for all things tech.

You may also like