Mozilla was one of the first companies to establish a bug bounty program and we continually adjust it so that it stays as relevant now as it always has been. To celebrate the 15 years of the 1.0 release of Firefox, we are making significant enhancements to the web bug bounty program.

Increasing Bounty Payouts

We are doubling all web payouts for critical, core and other Mozilla sites as per the Web and Services Bug Bounty Program page. In addition we are tripling payouts to $15,000 for Remote Code Execution payouts on critical sites!

Adding New Critical Sites to the Program

As we are constantly improving the services behind Firefox, we also need to ensure that sites we consider critical to our mission get the appropriate attention from the security community. Hence we have extended our web bug bounty program by the following sites in the last 6 months:

• Autograph – a cryptographic signature service that signs Mozilla products.
• Lando – Mozilla’s new automatic code-landing service which allows us to easily commit Phabricator revisions to their destination repository.
• Phabricator – a code management tool used for reviewing Firefox code changes.
• Taskcluster  the task execution framework that supports Mozilla’s continuous integration and release processes (promoted from core to critical).

Adding New Core Sites to the Program

The sites we consider core to our mission have also been extended to include:

• Firefox Monitor – a site where you can register your email address so that you can be informed if your account details are part of a data breach.
• Localization – a service contributors can use to help localize Mozilla products.
• Payment Subscription – a service that is used as the interface in front of the payment provide (Stripe).
• Firefox Private Network – a site from which you can download a desktop extension that helps secure and protect your connection everywhere you use Firefox.
• Ship It – a system that accepts requests for releases from humans and translates them into information and requests that our Buildbot-based release automation can process.
• Speak To Me – Mozilla’s Speech Recognition API.

The new payouts have already been applied to the most recently reported web bugs.

We hope the new sites and increased payments will encourage you to have another look at our sites and help us keep them safe for everyone who uses the web.

Happy Birthday, Firefox. And happy bug hunting to you all!

The post Updates to the Mozilla Web Security Bounty Program appeared first on Mozilla Security Blog.

https://blog.mozilla.org/security/2019/11/19/updates-to-the-mozilla-web-security-bounty-program/