Go straight to the menu Go straight to the text

Rewards Program

We appreciate your interest and intention to help improve the security of Samsung Mobile products.

We take security and privacy issues very seriously; and as an appreciation for helping Samsung Mobile improve the security of our products and minimizing risk to our end-consumers, we are offering a rewards program for eligible security vulnerability reports.

Please check below for more information on guidelines and eligibility for Samsung Mobile Security Rewards Program.

We look forward to your continued interests and participations in our Samsung Mobile Security Rewards Program. Through this rewards program, we hope to build and maintain valuable relationships with researchers who coordinate disclosure of security issues with Samsung Mobile.

To ensure smooth and timely operation, please make sure you carefully read and fully understand the requirements and guidelines below before submitting security reports for the rewards program.

Please refer to the Security Reporting page for submitting security reports.

Conditions for rewards qualification:
  1. 1. Security vulnerability report ("Report") must be applicable to eligible Samsung Mobile devices, services, applications developed and signed by Samsung Mobile, or eligible 3rd party applications developed for Samsung Mobile.
    • Eligible Samsung Mobile Devices in their latest available Android version and firmware:
      Galaxy S series (S9, S9+, S8, S8+, S8 Active, S8 Lite, S7, S7 edge, S7 Active)
      Galaxy Note series (Note 9, Note 8, Note FE)
      Galaxy A series (A3 (2017), A5 (2016), A5 (2017), A7 (2017), A6 (2018), Galaxy A6+ (2018), A8 (2018), A8+ (2018), A8 Star)
      Galaxy J series (J2 (2018), J2 Core (2018), J3 (2017), J3 Pop, J3 Top, J4, J5 (2017), J6, J7 (2017), J7 Max, J7 Neo, J7 Pop, J7 Duo, J7 Top, J7+ (2018), J8)
      Galaxy Tab series (Tab S2 L Refresh, Tab S2 S Refresh, Tab S3 9.7, Tab S4 10.5, Tab Active2, Tab A 10.1 (2016), Tab A (2017), Tab E (8.0) Refresh, Tab A 10.5)
    • Applicable Samsung Mobile services must be currently active. Vulnerabilities in services offered by other divisions of Samsung may not be eligible for a reward.
    • Applications developed and signed by Samsung Mobile must be up-to-date with the latest update.
    • Vulnerabilities in 3rd party software, in general, are not eligible for a reward.
  2. 2. In case of receiving duplicate Reports of a specific vulnerability, only the first Report is eligible for a reward. In some cases, Reports may also be considered duplicate if the patch for the vulnerability is already planned for release.
  3. 3. Reports related to the following categories are not eligible:
    • Software bugs that have no security impact
    • A behavior of the software that is consistent with the security concept implemented by Samsung
    • Require physical connection to the device with developer-level debugging tool including but not limited to ADB
    • Result in an application-level crash, or simply mention the possibility of MITM or SQL injection without an exploit
    • Scenarios requiring excessive user interaction or tricking users like phishing or clickjacking
    • Exploit is based on a complex scenario or the probability of exploit is very low
    • Vulnerability of a 3rd party code that affects not only Samsung devices but also other Android devices
    • Vulnerabilities (affecting Samsung as well as other Android devices) that are covered by other bug bounty programs (Android Rewards, Qualcomm Bug Bounty, etc.) do not qualify
    • Reports from people employed by Samsung and its affiliates, partners, or families of people employed by Samsung
    • Reports based on information taken or obtained through illegal access of Samsung Confidential information
    • Reports based on information that is already public
    • Scenarios that can be mitigated if secure lock (PIN, Pattern, Password, or Biometric) authentication is enforced
    • If Participant discloses any contents or information included in its Report before receiving the rewards or before receiving the disqualification notice from Samsung.
    • Reports not submitted through "Create Report" page, but sent via direct email (mobile.security@samsung.com).
  4. 4. Samsung Mobile Security Rewards Program("rewards program") is operated by Samsung Mobile and offers monetary rewards to eligible participants in order to improve the security of Samsung Mobile products and services. Thus, the process of the rewards program from start to payout, the decision of severity level and reward amount, and terms and conditions, will be entirely determined and governed by Samsung. The policy, guidelines, qualification requirements and eligibility requirements for the rewards program may change without advanced notice. We may also stop the rewards program at any time.
  5. 5. Participation in the rewards program and reporting to Samsung Mobile shall not involve any illegal activities:
    • Samsung Mobile services must not be interrupted and the reporting must not attack any Samsung internal or external servers, nor cause damage of data or physical assets.
    • Participation in the rewards program or reporting to Samsung Mobile must not violate any applicable laws and regulations, or infringe any third party rights (including intellectual property rights).
  6. 6. While participants’ comments and justifications will be carefully considered, Samsung will decide in its sole discretion:
    • Whether the Report qualifies for the rewards program
    • Which level of security risk ("severity") would be assigned to each Report
    • The final rewards amount
  7. 7. For rewards eligibility, participants are asked not to publish or disclose the vulnerability in public until coordination with Samsung via communication at mobile.security@samsung.com
  8. 8. Reported vulnerability or related exploits shall not be used for any illegal activities.
  9. 9. Residents from countries sanctioned by the government of South Korea are not eligible for the rewards program.
  10. 10. Depending on your local law, there may be additional restrictions on your eligibility to participate the rewards program.
  11. 11. You acknowledge and agree that the Reports may be shared with our partners.
Rewards amount and process
  1. 1. The severity level, as described in Samsung Mobile Security Risk Classification is classified to 5 levels (Critical, High, Moderate, Low, and No Security Impact) depending on the security risk and impact, and it will be decided by Samsung's internal evaluation in its sole discretion.
  2. 2. Depending on the severity level of the vulnerability, the rewards amount will range between USD $200 and USD $200,000 for qualified Reports. Please understand that no reward will be given to Reports with No Security Impact. Also, Reports that merely describe a software bug or a behavior of a software that is consistent with the security concept implemented by Samsung will be considered as Working as Intended with No Security Impact.
  3. 3. If the Report does not include a valid Proof-of-Concept, the qualification of rewards will be decided according to reproducibility and severity of the vulnerability, and the rewards amount may be reduced significantly.
  4. 4. Higher rewards amount will be offered for vulnerabilities with greater security risk and impact, and even higher rewards amount will be offered for vulnerabilities that lead to TEE or Bootloader compromise. On the other hand, rewards amount may be significantly reduced if the security vulnerability requires running as a privileged process.
  5. 5. You are responsible for any tax implications depending on your country of residency and citizenship. Withholding tax may be deducted from the monetary reward in accordance to the laws of applicable jurisdiction and the tax rate may differ by applicable countries.
  6. 6. The process and guidelines for the rewards program are as follows :
    • Participant submits vulnerability Report via Security Reporting page ⇒ Samsung Mobile performs internal evaluation of the vulnerability Report and confirms with assigned severity level, if valid ⇒ Samsung Mobile prepares remedy (the relevant security patch for the reported vulnerability) ⇒ If qualified, participants will be notified with rewards amount (Participants will be asked to provide their full name, country of residence and address, postal code, and phone number for rewards purpose) ⇒ For qualified Reports, rewards will be paid out through Samsung's designated partner Bugcrowd via payment processing and participants will be contacted by Bugcrowd during the process.

    Process Flow

    • Reported

      Submission of Vulnerability Report via Security Reporting Page (Samsung Account required)
    • Analyzing

      Internal Evaluation of Report and Severity Level based on Security Impact and Proof-of-Concept
    • Patching

      Development of Relevant Security Patch and final decision of Severity Level
    • Rewarded

      If qualified, Rewards paid out through Bugcrowd (via payment processing)
    • Closed

      Rewards payout is complete or the Report is Closed as [Duplicate/ No Security Impact/ Working as Intended/ AOSP / No information provided]
    • This rewards program process will be terminated if the Report or participant's handling of the vulnerability does not meet the qualification requirements or any other necessary conditions.
    • Once the rewards program process is initiated, it may take up to 2 months or more until the reward is paid out assuming the required documents are prepared with completeness and all required information are submitted on time.