Policy and restrictions
Low/medium reports generally receive no bounty. Respect privacy, availability and coordinated-disclosure requirements.
Eligibility and submission status
Generally original unreported findings, excluding reporters who contributed the faulty code or have a Mozilla business relationship. Age, payment and US sanctions requirements apply.
Web submissions paused September 11, 2026; reopening expected Q1 2027. Existing reports retain current-rate handling. Critical or actively exploited web issues retain a Bugzilla route. Firefox client bounty is unaffected.
Advertised rewards
Displayed critical-site ranges: High $3,000–$6,000 and Critical $6,000–$15,000. Core-category ranges: High $1,000–$3,000 and Critical $3,000–$5,000; special exceptions apply.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
addons.allizom.org | URL | Bounty eligible: Yes |
developer.mozilla.org | URL | Bounty eligible: Yes |
accounts.firefox.com | URL | Bounty eligible: Yes |
vpn.mozilla.org | URL | Bounty eligible: Yes |
relay.firefox.com | URL | Bounty eligible: Yes |
www.mozilla.org | URL | Bounty eligible: Yes |
support.mozilla.org | URL | Bounty eligible: Yes |
hg.mozilla.org | URL | Bounty eligible: Yes |
monitor.mozilla.org | URL | Bounty eligible: Yes |
aus5.mozilla.org | URL | Bounty eligible: Yes |
bugzilla.mozilla.org | URL | Bounty eligible: Yes |
crash-reports.allizom.org | URL | Bounty eligible: Yes |
crash-stats.allizom.org | URL | Bounty eligible: Yes |
firefox-ci-tc.services.mozilla.com | URL | Bounty eligible: Yes |
firefox.settings.services.mozilla.com | URL | Bounty eligible: Yes |
lando.services.mozilla.com | URL | Bounty eligible: Yes |
merino.services.mozilla.com | URL | Bounty eligible: Yes |
phabricator.allizom.org | URL | Bounty eligible: Yes |
sync.services.mozilla.com | URL | Bounty eligible: Yes |
www.firefox.com | URL | Bounty eligible: Yes |
pontoon.allizom.org | URL | Bounty eligible: Yes |
Product Delivery | OTHER | Bounty eligible: Yes |
Mozilla Ad Routing Service | OTHER | Bounty eligible: Yes |
Firefox Homepage Newtab | OTHER | Bounty eligible: Yes |
| Asset | Type | Group / eligibility |
|---|---|---|
| No rows captured. This does not establish that the program has no assets or restrictions. | ||
Review limitations
- Policy and September 11, 2026 notice were directly reviewed in the browser.
- Displayed rewards during the web-program pause do not imply general submission availability.
- Only dollar signs appear; ISO currency and normalized bounds remain null. Reopening is an expectation, not a confirmed future event.
Sources and provenance
- Mozilla Web Bug Bounty | Bounty Policy | HackerOne Mozilla / HackerOne · reviewed 2026-10-02
- Mozilla Web Bug Bounty | Updates | HackerOne Mozilla / HackerOne · reviewed 2026-10-02
- Published HackerOne structured scope Mozilla · reviewed 2026-10-03
Record reviewed 2026-10-02. Snapshot 53796974ace8. Open the complete JSON contract.