Terms and Conditions

  1. Apple Security Bounty awards are granted solely at our exclusive discretion. Any awards not accepted within one year, or waived, shall become ineligible for issuance. At our sole discretion, we may donate the value of such waived or other ineligible awards consistent with our charitable giving programs and policies.
  2. Apple reserves the right to immediately remove you from the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple, or if you violate any terms associated with the use of your Apple ID. This includes sending any harassing, threatening, or unlawful messages to Apple. Any such messages may be reported to relevant law enforcement entities.
  3. The Apple Security Bounty program extends to security research covering all Apple products and public-facing services, except research involving any of the following:
    1. Apple Pay
    2. Any non-public-facing Apple system
    3. Phishing, social engineering, or similar techniques
  4. The Apple Security Bounty program does not extend to third-party services.
  5. You must not disrupt, compromise, inappropriately access, store, or damage:
    1. Data or property (including a device) that you do not own, unless the data or property owner has given you express, written consent to disrupt, compromise, or damage the data or property; or
    2. Apple services in a manner that can adversely affect other users. Adverse effects solely impacting you are allowed.
  6. For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
  7. A participant in the Apple Security Bounty program will not be deemed to be in breach of applicable Apple license provisions which provide that a user of Apple software may not copy, decompile, reverse engineer, disassemble, attempt to derive the source code of, decrypt, modify, or create derivative works of such Apple software, for in-scope actions performed by that participant where all of the following are met:
    1. The actions were performed strictly during participation in the Apple Security Bounty program;
    2. The actions were performed during good-faith security research, which was — or was intended to be — responsibly reported to Apple; and
    3. Neither the actions nor the participant have otherwise violated or exceeded the scope of these terms and conditions.
  8. You must comply with all applicable laws (including directives, regulations, and ordinances), including those of the country or region in which you reside or in which you download or use Apple software or services.
  9. Apple Security Bounty awards may not be paid to you if you are in any U.S. embargoed countries or on the U.S. Treasury Department’s list of Specially Designated Nationals, the U.S. Department of Commerce Denied Person’s List or Entity List, or any other restricted party lists.
  10. You are responsible for the payment of all applicable taxes.