Mozilla Hall of Fame / Bug Bounty
Firefox, mozilla.org, Firefox Accounts, VPN, Pocket-era properties. Oldest continuous web bounty worth knowing.
Tags: vendor, browser, firefox
- Program model
- First-party VRP
- Regions
- Global
- Payout
- USD; browser bugs pay more than website bugs
Specialties: browser, web, auth
How to approach it
Website vs product vs core. A Firefox RCE is not filed the same way as an IDOR on a mozilla.org app.
- For web properties, start with accounts and add-ons.
- For browser, you are in a different league (sandbox, JIT).