Safety researchers play a vital position in software program improvement, figuring out and discovering vulnerabilities. It’s so essential that Apple Safety Analysis runs a Safety Bounty Program that provides payouts to researchers for his or her discoveries. Relying on the severity of the vulnerability, a researcher could make as a lot as $2 million for recognizing a bug, however, as one researcher exhibits, Apple’s notion of severity doesn’t at all times make sense.
A researcher who goes by RenwaX23 on X posted in regards to the bounty acquired for what appears to be a essential safety gap. Present in Safari, the outlet is a Common Cross-Web site Scripting (UXSS) vulnerability, a sort the place an attacker can impersonate a person and entry their information. On this occasion, RenwaX23 demonstrated that the outlet can be utilized to entry iCloud and the iOS Digicam app. The vulnerability was graded as Essential with a rating of 9.8 (on a scale of 10), so it wasn’t a small bug.
Recorded as CVE-2025-30466, Apple fastened it in Safari 18.4, which was launched with iOS/iPadOS 18.4 and macOS 15.4 replace again in March. RenwaX23 acquired a payment for the bug discovery–a measly $1,000.
Why the low payout? Some who responded to RenwaX23’s put up consider it’s as a result of Apple does think about the benefit with which a person might encounter the vulnerability. On this case, “an excessive amount of person interplay is required,” as gergely_kalman places it, to set off the exploit. Apple’s web site states that required person interplay is a part of the standards for figuring out bounties, together with the variety of affected customers, stage of entry, how effectively the report is written (which impacts how a lot work Apple must do), and different elements.
Apple’s web site additionally supplies kinds of vulnerabilities, pay scales, and examples, however as one other poster on the thread, Taiko_soup, factors out, Apple’s choices appear arbitrary. Taiko_soup found a vulnerability that appeared to have a $50,000 payout, however was provided $5,000.
Safety researchers put in a number of lengthy hours to search out holes and report them in order that customers can have safer software program. There appears to be a scarcity of perspective on Apple’s half to compensate researchers appropriately for the work they do. It doesn’t look good when an organization as giant as Apple lowballs its payouts.
When Apple releases OS updates, such because the latest macOS Sequoia 15.6 replace, they embody a number of safety fixes, as detailed on the Apple Safety Releases web site. On that web site, Apple lists the issues that have been addressed, and if you happen to have a look at every particular entry, you’ll see one thing referred to as a CVE quantity (which refers back to the report stored within the Widespread Vulnerabilities and Exposures database) and the title of an individual or group. That title is a researcher who found the vulnerability.
