4 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
A security researcher has criticized Apple's macOS bug bounty program for significantly lowering payouts for certain vulnerabilities. Despite increasing rewards for high-profile exploits, many macOS categories now offer much smaller financial incentives, which could discourage researchers from reporting flaws.
If you do, here's more
A security researcher, Csaba Fitzl, has voiced frustration over the reduced payouts in Apple's macOS bug bounty program. Despite Apple announcing increased rewards for some high-impact vulnerabilities, the payments for certain macOS flaws have plummeted. For instance, the bounty for full Transparency, Consent, and Control (TCC) bypasses has dropped dramatically from $30,500 to $5,000, with other TCC-related awards falling to as low as $1,000. Fitzl argues that this devaluation signals Apple's diminished commitment to macOS security.
Apple's bug bounty program now offers $1,000 for accessing sensitive user data on a locked device and other low-value bounties for exploits like malicious apps. In contrast, the company has significantly raised rewards for severe vulnerabilities, such as zero-click remote attacks, which now can yield up to $2 million. Fitzl believes the lower macOS bounties could deter researchers from focusing on the platform, potentially pushing them to seek vulnerabilities in more lucrative areas or sell exploits to third parties.
The shift in Apple's bounty structure raises concerns about macOS security overall. With fewer researchers motivated to report vulnerabilities, the platform may become more susceptible to attacks. Fitzl's comments highlight a broader tension between Apple's prioritization of iOS—where most of its revenue comes from—and the perceived neglect of macOS, which could impact the effectiveness of its security measures in the long run.
Questions about this article
No questions yet.