The Bug Bounty Program is an important part of security here at Mozilla. This program has paid out close to 1.6 million dollars to date and we are very happy with the success of it. We have a great community of researchers who have really contributed to the security of Firefox and our other products.
Those of us on the Bug Bounty Committee did an evaluation of the Firefox bug bounty program as it stands and decided it was time for a change.
First, we looked at how much we award for a vulnerability. The amount awarded was increased to $3000 five years ago and it is definitely time for this to be increased again. We have dramatically increased the amount of money that a vulnerability is worth. On top of that, we took a look at how we decided how much we should pay out. Rather than just one amount that can be awarded, we are moving to a variable payout based on the quality of the bug report, the severity of the bug, and how clearly the vulnerability can be exploited.
Finally, we looked into how we decide what vulnerability is worth a bounty award. Historically we would award $3000 for vulnerabilities rated Critical and High. Issues would come up where a vulnerability was interesting but was ultimately rated as Moderate. From now on, we will officially be paying out on Moderate rated vulnerabilities. The amount that is paid out will be determined by the committee, but the general range is $500 to $2000. This doesn’t mean that all Moderate vulnerabilities will be awarded a bounty but some will.
All of these changes can be found on our website here: here
Another exciting announcement to make is the official release of our Firefox Security Bug Bounty Hall of Fame! This page has been up for a while but we haven’t announced it until now. This is a great place to find your name if you are a researcher who has found a vulnerability or if you want to see all the people who have helped make Firefox so secure.
We will be making a Web and Services Bug Bounty Hall of Fame page very soon. Keep an eye out for that!
https://www.mozilla.org/en-US/security/bug-bounty/hall-of-fame/
Feel free to mail us at security@mozilla.com with any questions!