Policy and restrictions
Preserve confidentiality until Apple’s update and advisory; do not harm others’ data or availability. Apple Pay, non-public systems, third-party services, social engineering and unvalidated reports are excluded.
Eligibility and submission status
First complete actionable report through Apple’s portal; current-software/configuration requirements apply. Former employees, contractors and interns generally wait 18 months. Sanctions restrictions apply.
Official policy reviewed, but a live submission-acceptance indicator was not separately established.
Advertised rewards
Published base maximum $2,000,000; potential above $5,000,000 with applicable bonuses. Awards depend on demonstrated outcome, validation requirements and Apple’s discretion.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
iOS | operating_system | Current public release, including eligible beta |
iPadOS | operating_system | Current public release, including eligible beta |
macOS | operating_system | Current public release, including eligible beta |
tvOS | operating_system | Current public release, including eligible beta |
visionOS | operating_system | Current public release, including eligible beta |
watchOS | operating_system | Current public release, including eligible beta |
Publicly available Apple hardware | hardware | |
Apple-owned public-facing web servers and services | policy_category |
| Asset | Type | Group / eligibility |
|---|---|---|
Apple Pay | product | |
Non-public-facing Apple systems | policy_category | |
Third-party products and services | policy_category |
Review limitations
- Reviewed pages display dollar signs without an explicit ISO currency code; numeric currency-normalized bounds remain null.
- Bonus-qualified ceilings are not guaranteed awards and must not be treated as ordinary base payouts.
- No dedicated policy change-log URL was verified.
- Only guidelines and terms were refreshed for scope context; reward and announcement evidence retains its earlier retrieval date. Scope summaries are non-exhaustive, omit asset inventories and testing instructions, and grant no authorization.
Sources and provenance
- Apple Security Bounty Apple · reviewed 2026-10-02
- Apple bounty categories Apple · reviewed 2026-10-02
- Apple bounty guidelines Apple · reviewed 2026-10-03
- Apple security terms and conditions Apple · reviewed 2026-10-03
- Apple Security Bounty evolved Apple · reviewed 2026-10-02
- Apple Security Bounty guidelines Apple · reviewed 2026-10-03
- Apple Security Bounty terms Apple · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.