ProtonBlog(new window)

Proton’s partnership with Bug Bounty Switzerland continues

Share this page

Updated October 10, 2022

The Proton community trusts us to keep their information secure and private, and we take this trust seriously. That is why we are excited to announce that we will continue working with Bug Bounty Switzerland(new window) as part of our bug bounty program. Bug Bounty Switzerland has managed successful bug bounty programs for some of the largest Swiss companies, and our collaboration yielded impressive results.

In the past 10 months, over 30 vulnerability reports were submitted, 19 of which led to bounty awards amounting to more than €23,000. We would like to thank all the security researchers and ethical hackers who have contributed to our bug bounty program. Your work is helping keep the entire Proton community safe and advancing privacy around the world.

Since our partnership with Bug Bounty Switzerland began, Proton launched a new website, a new logo, and a unified encrypted ecosystem. With the new Proton, you can easily share information between Proton Mail, Proton Calendar, and Proton Drive while keeping it securely encrypted the entire time. This new ecosystem increases the functionality and usefulness of each individual service, but these interactions also increase the potential attack surface for bad actors. 

If you’re a hacker or security researcher with experience identifying and addressing penetration techniques used by nation-states and criminal organizations, we invite you to participate in our bug bounty program.  

We’re specifically looking for demonstrated expertise in the following areas:

  • Finding vulnerabilities in email and communication systems
  • Compromising encryption techniques
  • Compromising backend APIs
  • Hacking mobile applications, Windows, Linux, or macOS systems
  • Researching VPN technology

Proton will reward people for reporting vulnerabilities in our products. Key focus areas include:

  • Vulnerabilities that will compromise a Proton user’s personal data
  • Compromising Proton’s encryption (password leaks, private keys, etc.)
  • The ability to demonstrate unauthorized access to customer data (such as email, contacts, calendar, etc.)
  • Demonstrating EOP, sensitive information disclosure, or availability vulnerabilities in Proton products
  • Compromising Proton API or server infrastructure
  • Demonstrating the ability to compromise applications running on mobile devices, Windows, Linux, and Apple

We’ve expanded our bug bounty program to cover new Proton Calendar and Proton Drive apps for iOS, Android, and Windows (including apps that are in beta). You can see which apps are within the scope of our bug bounty program on our vulnerability disclosure policy.

Proton strives to maintain the highest software security standards for our products, and we’re innovators when it comes to the development and application of end-to-end encrypted services. We are committed to working closely with security researchers to ensure that our products are as secure as possible. If you find a qualifying bug, we will publicly acknowledge your contribution and reward you with a bounty. You can apply to be part of our bug bounty program(new window).

Protect your privacy with Proton
Create a free account

Share this page

Richie Koch(new window)

Prior to joining Proton, Richie spent several years working on tech solutions in the developing world. He joined the Proton team to advance the rights of online privacy and freedom.

Related articles

What is 3-2-1 backup
Data backup is vital for businesses and individuals alike: In case something happens to your primary computer, you always have a copy of your data to fall back on.  How should you approach backup, though? The 3-2-1 rule can act as a guide when decid
What was your first pet’s name? In what city were you born?  We’ve all had to answer these questions to reset a long-forgotten password, but consider how that works. Much of this information is easy to find for others (or easily forgotten by you), m
In the early days when Proton started, we often received a question along the lines of “I love the product and what Proton stands for, but how do I know you will still be around to protect my data 10 years from now?”  Ten years and 100 million accou
Credential stuffing is a popular type of cyberattack where attackers take login credentials and use them on thousands of websites, hoping to fraudulently gain access to people’s accounts. It’s an effective attack, but fortunately, one that’s easy to
With Skiff abruptly shutting down operations, many people are on the lookout for alternatives that don’t compromise on privacy — and won’t suddenly disappear. People were attracted to Skiff because it promised privacy, no ads, end-to-end encryption,
Skiff is dead. On Feb. 9, the email company Skiff announced it was being bought by Notion. Many Skiff customers have been shocked by this news, as their inboxes have been sold out from under them. Skiff gave people six months to export their data be