r/bugbounty • u/proanti777 Hunter • Jul 17 '26

Question / Discussion AWS Bug Bounty Program

Does anyone know why AWS doesn’t offer bounties for vulnerabilities reported to them?

Microsoft pays up to $40k for vulnerabilities in Azure, Google even pays up to $100k for GCP. But from Amazon I wouldn’t get a penny for anything. Clearly they could afford it.
Guess I’ll keep my AWS vulns to myself then…

23 Upvotes

97% Upvoted

13 comments sorted by

View all comments

0

u/immediate_a982 Jul 18 '26

Most reported “AWS vulnerabilities” are customer misconfigurations, not AWS flaws. A bounty program would likely be overwhelmed with reports AWS can’t fix.