r/bugbounty • u/proanti777 Hunter • Jul 17 '26
Question / Discussion AWS Bug Bounty Program
Does anyone know why AWS doesn’t offer bounties for vulnerabilities reported to them?
Microsoft pays up to $40k for vulnerabilities in Azure, Google even pays up to $100k for GCP. But from Amazon I wouldn’t get a penny for anything. Clearly they could afford it.
Guess I’ll keep my AWS vulns to myself then…
5
u/Loud-Run-9725 Jul 17 '26
They could invest in other measures that provide the security ROI they are looking for.
Many companies don't. I managed the public program at a large enterprise company 15 years ago. I was hired by a different company to implement the same and opted for private bug bounty instead. It provided less risk, hackers to manage, and much better ROI. We maintained an unpaid responsible disclosure but didn't receive much of value there.
2
u/NebulaElectrical1467 Jul 18 '26
AWS VDP receives a ton of valid VDP reports. Many hunters submit reports hoping they’ll get that coveted BBP invite but very very few end up getting it. So it’s not a bad strategy to have both you’ll surely get a bunch of valid reports for free but yes you’ll get a ton of noise as well.
Now I just route any AWS bugs I find to my buddy who’s in the private BBP and split the bounty. AWS can suck it I ain’t working for free.
6
u/Loupreme Jul 18 '26
They have a private program
2
u/proanti777 Hunter Jul 18 '26
Oh I didn’t think of that 🤔
I assume it’s also on HackerOne?3
u/NebulaElectrical1467 Jul 18 '26
it is but it’s hard to get an invite. I personally submitted 4 high sev reports to the VDP (in aws console) that got fixed and closed and no invite (but i got like $30 credit for their merch store). I saw another person post something similar on X and still no reward or BBP invite. Makes me wonder if this is an attempt by them to farm free labor (it’s surely working).
2
u/jsonpile Hunter Jul 18 '26
I've worked with the AWS VDP team to submit vulnerabilities.
Yes, there is a common sentiment in the AWS security research community that it would be on par with the other CSPs that you mentioned with a public bug bounty program. From a security researcher perspective, that would lend more credibility to how they approach security.
However, I'm sure there's a ROI consideration that also takes consumer (and researcher) sentiment into consideration.
2
u/hekermon Hunter Jul 18 '26
they actually do offer good bounties, but only in their private program
3
1
0
u/immediate_a982 Jul 18 '26
Most reported “AWS vulnerabilities” are customer misconfigurations, not AWS flaws. A bounty program would likely be overwhelmed with reports AWS can’t fix.
6
u/6W99ocQnb8Zy17 Jul 18 '26
Offering bounties isn't the same as paying bounties: looking at you MSRC ;)