Updated October 10, 2022
The Proton community trusts us to keep their information secure and private, and we take this trust seriously. That is why we are excited to announce that we will continue working with Bug Bounty Switzerland(new window) as part of our bug bounty program. Bug Bounty Switzerland has managed successful bug bounty programs for some of the largest Swiss companies, and our collaboration yielded impressive results.
In the past 10 months, over 30 vulnerability reports were submitted, 19 of which led to bounty awards amounting to more than €23,000. We would like to thank all the security researchers and ethical hackers who have contributed to our bug bounty program. Your work is helping keep the entire Proton community safe and advancing privacy around the world.
Since our partnership with Bug Bounty Switzerland began, Proton launched a new website, a new logo, and a unified encrypted ecosystem. With the new Proton, you can easily share information between Proton Mail, Proton Calendar, and Proton Drive while keeping it securely encrypted the entire time. This new ecosystem increases the functionality and usefulness of each individual service, but these interactions also increase the potential attack surface for bad actors.
If you’re a hacker or security researcher with experience identifying and addressing penetration techniques used by nation-states and criminal organizations, we invite you to participate in our bug bounty program.
We’re specifically looking for demonstrated expertise in the following areas:
- Finding vulnerabilities in email and communication systems
- Compromising encryption techniques
- Compromising backend APIs
- Hacking mobile applications, Windows, Linux, or macOS systems
- Researching VPN technology
Proton will reward people for reporting vulnerabilities in our products. Key focus areas include:
- Vulnerabilities that will compromise a Proton user’s personal data
- Compromising Proton’s encryption (password leaks, private keys, etc.)
- The ability to demonstrate unauthorized access to customer data (such as email, contacts, calendar, etc.)
- Demonstrating EOP, sensitive information disclosure, or availability vulnerabilities in Proton products
- Compromising Proton API or server infrastructure
- Demonstrating the ability to compromise applications running on mobile devices, Windows, Linux, and Apple
We’ve expanded our bug bounty program to cover new Proton Calendar and Proton Drive apps for iOS, Android, and Windows (including apps that are in beta). You can see which apps are within the scope of our bug bounty program on our vulnerability disclosure policy.
Proton strives to maintain the highest software security standards for our products, and we’re innovators when it comes to the development and application of end-to-end encrypted services. We are committed to working closely with security researchers to ensure that our products are as secure as possible. If you find a qualifying bug, we will publicly acknowledge your contribution and reward you with a bounty. You can apply to be part of our bug bounty program(new window).
