Policy and restrictions
No unlawful activity, privacy harm, disruption, physical access, spam or social engineering. Premature public or third-party disclosure forfeits eligibility. Unsupported scanner output and compromised-device scenarios generally do not qualify. Legal protection depends on following the rules.
Eligibility and submission status
First reports take precedence; duplicates do not qualify. Reports must be in English and produce a code or configuration change. Recipients bear taxes and fees. Unrelated third-party implementation faults are excluded.
The policy explicitly describes continuous operation since 2014 and direct email submissions. It expressly disclaims third-party bounty-platform participation.
Advertised rewards
Advertised awards range from $100 to $100,000 or more: application-level guidance reaches $10,000, while protocol-level awards may exceed $100,000. Validity and amounts remain discretionary. Dollar denomination is unverified, so normalized bounds remain null.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
telegram.org | domain | |
*.telegram.org | domain_pattern | |
t.me | domain | |
*.t.me | domain_pattern | |
tg.dev | domain | |
*.tg.dev | domain_pattern | |
telegram.me | domain | |
*.telegram.me | domain_pattern | |
*.telesco.pe | domain_pattern | |
*.stel.com | domain_pattern | |
contest.com | domain | |
quiz.directory | domain | |
telegra.ph | domain | |
Official Telegram applications | application | |
MTProto 2.0 | protocol | |
Telegram-operated services and servers handling private user data | policy_category |
| Asset | Type | Group / eligibility |
|---|---|---|
Third-party domains integrating Telegram | policy_category | |
Third-party apps and bots | policy_category |
Review limitations
- No revision date, dedicated change log, age or residency criterion was established. Intake was not tested.
- Advertised figures are not individual awards. Scope inventories and testing instructions are omitted; full live terms prevail.
Sources and provenance
- Telegram Bug Bounty Program Telegram · reviewed 2026-10-03
- Telegram Bug Bounty Program Telegram · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.