Go straight to the menu Go straight to the text

Rewards Program

We appreciate your interest and intention to help improve the security of Samsung Mobile products.

We take security and privacy issues very seriously; and as an appreciation for helping Samsung Mobile improve the security of our products and minimizing risk to our end-consumers, we are offering a rewards program for eligible security vulnerability reports.

Please check below for more information on guidelines and eligibility for Samsung Mobile Security Rewards Program.

We look forward to your continued interests and participations in our Samsung Mobile Security Rewards Program. Through this rewards program, we hope to build and maintain valuable relationships with researchers who coordinate disclosure of security issues with Samsung Mobile.

To ensure smooth and timely operation, please make sure you carefully read and fully understand the requirements and guidelines below before submitting security reports for the rewards program.

Please refer to the Security Reporting page for submitting security reports.

Conditions for rewards qualification:
  1. 1. Security vulnerability report ("Report") must be applicable to eligible Samsung Mobile devices, services, applications developed and signed by Samsung Mobile, or eligible third party applications developed for Samsung.
    • Eligible Samsung Mobile Devices in their latest available Android version and firmware:
      Galaxy S series (S9, S9+, S8, S8+, S8 Active, S8 Lite, S7, S7 edge, S7 Active, S6 edge+)
      Galaxy Note series (Note 8, Note FE, Note 5)
      Galaxy A series (A3 (2017), A5 (2016), A5 (2017), A7 (2017), A6 (2018), Galaxy A6+ (2018), A8 (2018), A8+ (2018), A8 Star)
      Galaxy J series (J1 Mini Prime, J2 (2016), J2 (2018), J3 (2017), J3 Pop, J3 Top, J4, J5 (2017), J6, J7 (2017), J7 Max, J7 Neo, J7 Pop, J7 Duo, J7 Top, J8)
      Galaxy Tab series (Tab S2 L Refresh, Tab S2 S Refresh, Tab S3 9.7, Tab Active2, Tab A 10.1 (2016), Tab A (2017), Tab E (8.0) Refresh)
    • Applicable Samsung Mobile services must be currently active.
    • Applications developed and signed by Samsung Mobile must be up-to-date with the latest update.
    • Vulnerabilities on 3rd party applications must be specific to Samsung Mobile devices, applications or services.
  2. 2. In case of receiving duplicate Reports of a specific vulnerability, only the first Report is eligible for a reward.
  3. 3. Reports related to the following categories are not eligible:
    • Software bugs that have no security impact
    • Require physical connection to the device with developer-level debugging tool including but not limited to ADB
    • Result in an application-level crash, or simply mention the possibility of MITM or SQL injection without an exploit
    • Scenarios requiring excessive user interaction or tricking users like phishing or clickjacking
    • Exploit is based on a complex scenario or the probability of exploit is very low
    • Vulnerability of a 3rd party code that affects not only Samsung devices but also other Android devices
    • Vulnerabilities (affecting Samsung as well as other Android devices) that are covered by other bug bounty programs (Android Rewards, Qualcomm Bug Bounty, etc.) do not qualify
    • Reports from people employed by Samsung and its affiliates, partners, or families of people employed by Samsung
    • Reports based on information taken or obtained through illegal access of Samsung Confidential information
    • Reports based on information that is already public
    • Scenarios that can be mitigated if secure lock (PIN, Pattern, Password, or Biometric) authentication is enforced
    • If Participant discloses any contents or information included in its Report before receiving the rewards or before receiving the disqualification notice from Samsung.
    • Reports not submitted through "Create Report" page, but sent via direct email (mobile.security@samsung.com).
  4. 4. Samsung Mobile Security Rewards Program("rewards program") is operated by Samsung Mobile and offers monetary rewards to eligible participants in order to improve the security of Samsung Mobile products and services. Thus, the process of the rewards program from start to payout, the decision of severity level and reward amount, and terms and conditions, will be entirely determined and governed by Samsung. The policy, guidelines, qualification requirements and eligibility requirements for the rewards program may change without advanced notice. We may also stop the rewards program at any time.Participants acknowledge and agree that the submitted Report will not be returned to the participant and regardless of receiving any rewards for the Report, any information and contents in the Report may be used by Samsung Mobile to enhance the security of its products.
  5. 5. Participation in the rewards program and reporting to Samsung Mobile shall not involve any illegal activities:
    • Samsung Mobile services shall not be interrupted and the reporting shall not attack any Samsung internal or external servers, nor cause damage of data or physical assets.
    • Participation in the rewards program or reporting to Samsung Mobile shall not violate any applicable laws and regulations, or infringe any third party rights (including intellectual property rights).
  6. 6. Samsung will decide in its sole discretion: (Participants shall not claim for any decisions made by Samsung)
    • Whether the Report qualifies for the rewards program
    • Which level of security risk ("severity") would be assigned to each Report
    • The final rewards amount
  7. 7. Reported vulnerability shall not be published or disclosed in public until agreed and approved by Samsung Mobile.
  8. 8. Reported vulnerability or related exploits shall not be used for any illegal activities.
  9. 9. Residents from countries sanctioned by the government of South Korea are not eligible for the rewards program.
  10. 10. Depending on your local law, there may be additional restrictions on your eligibility to participate the rewards program.
  11. 11. You acknowledge and agree that the Reports may be shared with our partners.
Rewards amount and process
  1. 1. The severity is classified to 4 levels (Critical, High, Moderate, and Low) depending on the security risk and impact, and it will be decided by Samsung's internal evaluation in its sole discretion.
  2. 2. Depending on the severity level of the vulnerability, the rewards amount will range between USD $200 and USD $200,000 for qualified Reports. Please understand that no reward will be given to Reports with No Security Impact.
  3. 3. If the Report does not include a valid Proof-of-Concept, the qualification of rewards will be decided according to reproducibility and severity of the vulnerability, and the rewards amount may be reduced significantly.
  4. 4. Higher rewards amount will be offered for vulnerabilities with greater security risk and impact, and even higher rewards amount will be offered for vulnerabilities that lead to TEE or Bootloader compromise. On the other hand, rewards amount may be significantly reduced if the security vulnerability requires running as a privileged process.
  5. 5. You are responsible for any tax implications depending on your country of residency and citizenship. Withholding tax may be deducted from the monetary reward in accordance to the laws of applicable jurisdiction and the tax rate may differ by applicable countries.
  6. 6. The process and guidelines for the rewards program are as follows :
    • Participant submits vulnerability Report via Security Reporting page ⇒ Samsung Mobile performs internal evaluation of the vulnerability Report and confirms with assigned severity level, if valid ⇒ Samsung Mobile prepares remedy (the relevant security patch for the reported vulnerability) ⇒ If qualified, participants will be notified with rewards amount ⇒ Rewards payout may be processed by Samsung Mobile or a third party designated by Samsung Mobile depending on the location of the participant or any other factors.
    • This rewards program process will be terminated if the Report or participant's handling of the vulnerability does not qualify all requirements and any other necessary conditions.
    • Once the rewards program is initiated, it may take up to 2 months or more until the reward is paid out assuming the required documents are prepared with completeness and submitted on time.