Welcome to the AT&T Bug Bounty Program! We now use a pay per vulnerability model and utilize the HackerOne platform! The Program encourages and rewards contributions by developers and security researchers who help make AT&T's public-facing online environment more secure. Through the Program AT&T provides monetary rewards and/or public recognition for security vulnerabilities responsibly disclosed to us.
The following explains the details of the Program. If you are new to our Program, please be sure to review the Program Guidelines, Program Exclusions, and Terms and Conditions, as well as the Reporting and Payment Process prior to making a submission.Report Bug
The Program applies to security vulnerabilities found within AT&T's Environment, which includes, but is not limited to, AT&T’s websites, exposed APIs, mobile applications, and devices. At this time, any vulnerabilities submitted that are specific to WarnerMedia assets, including HBO, are out-of-scope of the AT&T program and are therefore ineligible for bounty rewards.
A security vulnerability is generally an error, flaw, mistake, failure, or fault in a computer program or system that impacts the security of a device, system, network, or data. Any security vulnerability may be considered for the Program; however, it must be a new, previously unreported, vulnerability in order to be eligible for reward or recognition. Typically, in-scope submissions will include high impact vulnerabilities. However, any vulnerability that could realistically place the online security of AT&T, our customers, or the public at large at risk is in scope and might be rewarded.
Vulnerabilities which directly or indirectly affect the confidentiality or integrity of user data or privacy are prime candidates for a reward. Some characteristics that are considered when "qualifying" vulnerabilities include those that:
The following categories of vulnerabilities are excluded from reward in the Program unless otherwise directed by AT&T:
In addition, the submitter:
Vulnerabilities that are disclosed to any party other than AT&T, including vulnerability brokers, will not qualify for reward. This includes both public disclosure and limited private release.
Program Terms and Conditions
The following Terms and Conditions apply to the Program:
When reporting vulnerabilities, you must first register or log on to your account on HackerOne.
In describing the vulnerability it is important to include all necessary details required for reproducing the vulnerability as well as the tools required to reproduce the vulnerability. Please note that the vulnerability should be treated in accordance with the terms of the Program.
Each submission will typically receive a reply within one (1) business day acknowledging that the report was successfully received.
Duplicate submissions (where the vulnerability has already been reported to AT&T) are not eligible for rewards. In most instances, you will not be notified of a duplicate report condition until after the vulnerability has been remediated.
Please recognize that AT&T operates a complex Environment and the amount of time required to address a reported issue can vary from a few hours to several months. You will receive notification of the final outcome of our remediation efforts once the Program is notified by AT&T internal support team. AT&T cannot provide updates on remediation efforts that are in progress.
Only vulnerabilities will be considered for an award. Only those vulnerabilities that have been resolved will receive an award. The bounties range from $50 to $2,000 depending on criteria such as the type/severity of the vulnerability, impacted domain(s), potential vulnerability exploits, and vulnerability report submission quality. In general, Reflected XSS will be considered low severity and awarded with minimum bounty unless other impact is shown. THE CRITERIA USED TO DETERMINE THE PAYOUT FOR A VULNERABILITY IS SOLELY AT THE DISCRETION OF AT&T.
Change to Program Terms
AT&T reserves the right to discontinue the Program at any time without notice in its sole discretion.
Frequently Asked Questions
What's eligible for AT&T Bug Bounty?
Pretty much any security exposure on AT&T’s IP footprint is eligible for program recognition. We’re not just considering websites -- mobile/tablet apps and connected devices are included too!
What types of issues will be considered as part of the AT&T Bug Bounty program?
Anything that could realistically place the online security of AT&T or our customers at risk will be considered. We are, however, particularly interested in vulnerabilities that could expose customer or enterprise data.
There are a few exclusions which can be found on the AT&T Bug Bounty Website. Please read our terms/conditions, and if you have any questions send us a note at firstname.lastname@example.org.
You fixed my bug...where's my bounty?
Please refer to the Reporting Process
How can I increase my chances of getting an AT&T Bug Bounty Award?
Typically we consider the severity of the bug, ease of exploit, and prominence of the site(s) or apps included in all remediated reports from a security researcher. This process is designed to recognize the most significant and impactful contributions.
Submissions that clearly articulate how the vulnerability leads to a compromise of customer or enterprise data or accounts, as well those that prove the existence of remote command execution vulnerability, are typically preferred.
Less severe issues or bugs that require multiple or unusual steps on the part of a potential victim (such as installing a browser plug-in) may be included, but usually don’t result in significant bounties.
Tip: Well written reports are a definite plus!
What makes up a well written report?
What's taking so long to remediate my reported issue?
We take your reports seriously and do our best to address issues as quickly possible. Depending on the specific issue, it can take anywhere from a few hours to several months for a fix to be implemented.
Practical realities, such as the complexity of the environment and other priorities can all impact our responsiveness. There are also times when we may elect to defer remediation due to pending site upgrades and other such factors.
Why do you not respond to my request for information?
Our apologies, but we get a lot of questions and just do not have the staff to respond to individual requests for information. Be assured, however, that we are working on ways to communicate better and more efficiently in the future.
Thanks for your understanding!
I want to point to my success detecting security issues on your site to future employers but Section 5 seems to prevent me from doing that. What can I do?
Please drop us a note at email@example.com. We are happy to support disclosure and make sure you get credit from other organizations for your work once we’re sure our customers are not at risk. Our goal is simply to address vulnerabilities before publication so that we don’t have bad people reproducing your work for malicious ends.
What do you mean by "duplicate" submission...and why didn't you tell me when I first submitted the report?
Please refer to the Reporting Process
Why was my report of "Unvalidated Redirects and Forwards" rejected?
When testing our environment for open redirects keep in mind that AT&T operates at a very large scale. Avoid using redirects to domains of common web-based service providers such as Yahoo!, Twitter, or Facebook, in your proof-of-vulnerability analysis.