Microsoft Launches Xbox Bug Bounty Program with Rewards Up to $20,000
Microsoft has officially announced the launch of a bug bounty program for its Xbox gaming platform. Researchers can earn between $500 and $20,000 for discovering vulnerabilities in the Xbox Live network and related services.
Who Can Participate?
The new vulnerability rewards program is open to everyone, whether you’re a casual gamer or a top-tier cybersecurity expert. According to the Microsoft Security Response Center, all you need is a clear description of the issue and a concise proof of concept (PoC). This allows the Xbox team to assess the potential risk and reproduce the vulnerability before fixing it.
Scope and Rules
The bug bounty covers the backend infrastructure of the Xbox Live cloud. However, Microsoft will automatically disqualify researchers who:
- Attempt to access confidential Xbox user data
- Use phishing or social engineering against Xbox users or employees
- Try to move laterally within the Xbox network beyond what’s necessary to demonstrate the vulnerability’s impact
What Types of Bugs Are Eligible?
Microsoft is interested in bugs that lead to code execution, privilege escalation, security bypasses, information disclosure, spoofing, and other significant changes. The program does not cover denial-of-service (DoS) issues.
Reward Structure
Rewards for discovered bugs will be paid according to the following guidelines:
- Remote code execution vulnerabilities: $5,000 to $20,000
- Privilege escalation vulnerabilities: $1,000 to $8,000
Other types of vulnerabilities may also be rewarded, depending on their severity and impact.