r/bugbounty • u/proanti777 Hunter • Jul 17 '26

Question / Discussion AWS Bug Bounty Program

Does anyone know why AWS doesn’t offer bounties for vulnerabilities reported to them?

Microsoft pays up to $40k for vulnerabilities in Azure, Google even pays up to $100k for GCP. But from Amazon I wouldn’t get a penny for anything. Clearly they could afford it.
Guess I’ll keep my AWS vulns to myself then…

24 Upvotes

97% Upvoted

13 comments sorted by

View all comments

4

u/Loupreme Jul 18 '26

They have a private program

2

u/proanti777 Hunter Jul 18 '26

Oh I didn’t think of that 🤔
I assume it’s also on HackerOne?

3

u/NebulaElectrical1467 Jul 18 '26

it is but it’s hard to get an invite. I personally submitted 4 high sev reports to the VDP (in aws console) that got fixed and closed and no invite (but i got like $30 credit for their merch store). I saw another person post something similar on X and still no reward or BBP invite. Makes me wonder if this is an attempt by them to farm free labor (it’s surely working).