Terms and Conditions

By submitting a report to the Apple Security Bounty program, you agree to comply with and be bound by these terms and conditions. Violating any of these terms makes your report ineligible for an award.

  1. Apple Security Bounty awards are granted solely at our exclusive discretion. You understand and agree that submitting a report does not guarantee that you will receive a reward.
  2. Any awards not accepted within one year, or waived, shall become ineligible for issuance. At our sole discretion, we may donate the value of such waived or other ineligible awards consistent with our charitable giving programs and policies.
  3. Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple, including:
    1. Violation of any terms associated with the use of your Apple Account.
    2. Sending harassing, threatening, or unlawful messages to Apple. Any such messages may be reported to relevant law enforcement entities.
    3. A consistent, repeated, or high-volume pattern of submitting spam, ineligible reports, or incorrect or false claims of a security or privacy issue, such as reports generated by or with the assistance of AI that are not validated by human review.
    4. Repeatedly reopening cases closed after final Apple Security Bounty award decisions. Attempts to repeatedly reopen such issues will not receive a response.
  4. For a reported security vulnerability affecting any Apple platform to be eligible for an Apple Security Bounty award, you must not disclose it to anyone other than Apple until after Apple has released a software update and published a security advisory for the reported security vulnerability.
  5. The Apple Security Bounty program extends to security research covering all Apple products and public-facing services, except research involving any of the following:
    1. Apple Pay
    2. Any non-public-facing Apple system
    3. Phishing, social engineering, or similar techniques
  6. The Apple Security Bounty program does not extend to third-party services.
  7. You must not disrupt, compromise, inappropriately access, store, or damage:
    1. Data or property (including a device) that you do not own, unless the data or property owner has given you express, written consent to disrupt, compromise, or damage the data or property; or
    2. Apple services in a manner that can adversely affect other users. Adverse effects solely impacting you are allowed.
  8. A participant in the Apple Security Bounty program will not be deemed to be in breach of applicable Apple license provisions which provide that a user of Apple software may not copy, decompile, reverse engineer, disassemble, attempt to derive the source code of, decrypt, modify, or create derivative works of such Apple software, for in-scope actions performed by that participant where all of the following are met:
    1. The actions were performed strictly during participation in the Apple Security Bounty program;
    2. The actions were performed during good-faith security research, which was — or was intended to be — responsibly reported to Apple; and
    3. Neither the actions nor the participant have otherwise violated or exceeded the scope of these terms and conditions.
  9. Former Apple employees, contractors, and interns are eligible to participate in the Apple Security Bounty program no sooner than 18 months after ending employment with Apple or with an Apple vendor or supplier. We may extend this period at our sole discretion if your report is related to such prior work or job functions for Apple.
  10. You must comply with all applicable laws (including directives, regulations, and ordinances), including those of the country or region in which you reside or in which you download or use Apple software or services.
  11. Apple Security Bounty awards may not be paid to you if you are in any U.S. embargoed countries or on the U.S. Treasury Department’s list of Specially Designated Nationals, the U.S. Department of Commerce's Denied Persons List or Entity List, or any other restricted party lists.
  12. You are responsible for the payment of all applicable taxes.