Policy and restrictions
Only explicitly included services qualify. No third-party, physical, social-engineering or disruptive activity, malware, data alteration, exfiltration or persistence. Stop and notify Proton upon finding a vulnerability or nonpublic-data exposure; purge retained nonpublic data when reporting. Disclosure normally waits 120 days after acknowledgment. Conditional safe harbor cannot bind third parties.
Eligibility and submission status
First valid reports with concrete, reproducible security impact qualify after confirmation and deployment of a fix. Intended behavior and unsupported theoretical recommendations are excluded. Anonymous reporting is allowed; submissions must respect third-party intellectual property and grant Proton a broad report-use license.
The disclosure policy explicitly states that reports are accepted by email. This is policy evidence, not a delivery or response test.
Advertised rewards
Published paid bands start at USD 1,000; the ordinary critical band ends at USD 50,000, with an exceptional ceiling of USD 100,000. Low-severity rewards are discretionary and normally nonmonetary. These are advertised guidelines, not individual awards.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
proton.me | website | Proton |
account.proton.me | web_app | Proton |
calendar.proton.me | web_app | Proton Calendar |
Proton Calendar apps (Android, iOS/iPad) | mobile_app | Proton Calendar |
drive.proton.me | web_app | Proton Drive |
Proton Drive apps (Android, iOS/iPad beta, Windows) | application | Proton Drive |
docs.proton.me | web_app | Proton Docs |
mail.proton.me | web_app | Proton Mail |
api.protonmail.ch | web_app | Proton Mail |
Proton Mail mobile apps (Android, iOS/iPad) | mobile_app | Proton Mail |
Proton Bridge (GNU/Linux, macOS, Windows) | desktop_app | Proton Mail |
Proton Scribe | product | Proton Mail |
pass.proton.me | web_app | Proton Pass |
Proton Pass mobile apps (Android, iOS/iPad) | mobile_app | Proton Pass |
Proton Pass desktop apps (Linux, macOS, Windows) | desktop_app | Proton Pass |
Proton Pass extensions (Chrome, Firefox) | browser_extension | Proton Pass |
Proton Authenticator mobile apps (Android, iOS/iPad) | mobile_app | Proton Authenticator |
Proton Authenticator desktop apps (Linux, macOS, Windows) | desktop_app | Proton Authenticator |
protonvpn.com | website | Proton VPN |
account.protonvpn.com | web_app | Proton VPN |
api.protonvpn.ch | web_app | Proton VPN |
Proton VPN apps (Android, iOS/iPad, Linux, macOS, Windows) | application | Proton VPN |
Proton VPN extensions (Android TV, Apple TV, Chrome, Chromebook, Firefox) | browser_extension | Proton VPN |
wallet.proton.me | web_app | Proton Wallet |
Proton Wallet apps (Android, iOS) | mobile_app | Proton Wallet |
lumo.proton.me | web_app | Lumo by Proton |
Proton Lumo apps (Android, iOS) | mobile_app | Lumo by Proton |
simplelogin.io | website | SimpleLogin |
app.simplelogin.io | web_app | SimpleLogin |
SimpleLogin mobile apps (Android, iOS) | mobile_app | SimpleLogin |
SimpleLogin extensions (Chrome, Edge, Firefox, Safari) | browser_extension | SimpleLogin |
standardnotes.com | website | Standard Notes |
app.standardnotes.com | web_app | Standard Notes |
Standard Notes apps (Android, iOS/iPad, Linux, macOS, Windows) | application | Standard Notes |
| Asset | Type | Group / eligibility |
|---|---|---|
shop.proton.me | domain | |
proton.me/support/contact | website | |
protonmail.zendesk.com | domain | |
support.protonmail.com | domain | |
help.protonmail.com | domain | |
status.proton.me | domain | |
partners.proton.me | domain | |
localize.proton.me | domain |
Review limitations
- The disclosure policy is dated July 30, 2025; safe harbor September 29, 2022. The bounty page shows no overall revision date.
- The numeric minimum is the lowest published paid tier, not a guaranteed payout floor; low-severity cases have no fixed monetary schedule.
- No program-specific age, residency or employee eligibility rule was established from these pages. No submission was made.
- Public policy review only. Asset inventories and operational instructions are omitted. Live terms prevail; this summary grants no authorization or legal protection.
Sources and provenance
- Proton bug bounty program Proton AG · reviewed 2026-10-03
- Proton vulnerability disclosure policy Proton AG · reviewed 2026-10-03
- Proton legal safe harbor policy Proton AG · reviewed 2026-10-03
- Proton vulnerability disclosure scope Proton AG · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.