AT&T Bug Bounty Program Policy
Welcome to the AT&T Bug Bounty Program! We now use a pay per vulnerability
model and utilize the HackerOne platform!
The Program encourages and rewards contributions by developers and security
researchers who help make AT&T's public-facing online environment more secure.
Through the Program AT&T provides monetary rewards and/or public recognition
for security vulnerabilities responsibly disclosed to us.
The following explains the details of the Program. If you are new to our
Program, please be sure to review the Program Guidelines, Program Exclusions,
and Terms and Conditions, as well as the Reporting and Payment Process prior
to making a submission.
The Program applies to security vulnerabilities found within AT&T's
Environment, which includes, but is not limited to, AT&T’s websites, exposed
APIs, mobile applications, and devices. A security vulnerability is generally
an error, flaw, mistake, failure, or fault in a computer program or system
that impacts the security of a device, system, network, or data. Any security
vulnerability may be considered for the Program; however, it must be a new,
previously unreported, vulnerability in order to be eligible for reward or
Typically, in-scope submissions will include high impact vulnerabilities.
However, any vulnerability that could realistically place the online security
of AT&T, our customers, or the public at large at risk is in scope and might
be rewarded. Vulnerabilities which directly or indirectly affect the
confidentiality or integrity of user data or privacy are prime candidates for
a reward. Some characteristics that are considered when "qualifying"
vulnerabilities include those that:
- Directly or indirectly affect the confidentiality or integrity of user data or privacy;
- Compromise the integrity of the system;
- Enable unauthorized access to significant data or resources;
- Enable the running of unauthorized code;
- Increase privileges or access beyond that which is intended;
- Interfere with or bypass security controls or mechanisms;
- Are exploitable (i.e. not purely theoretical);
- Can be launched remotely; and
- Could cause damage to a user's system.
The following categories of vulnerabilities are excluded from reward in the
Program unless otherwise directed by AT&T:
- Attacks against AT&T infrastructure;
- Social engineering and physical attacks;
- Distributed Denial of Service attacks that require large volumes of data;
- Provisioning and/or usability issues;
- Violations of licenses or other restrictions applicable to any vendor's product;
- Security vulnerabilities in third-party products or websites that are not under AT&T’s direct control;
- Duplicate reports of security issues, including security issues that have already been identified internally;
- Tenant/cloud systems executing in an Internet Data Center (IDC), where AT&T is simply acting as the site host;
- Employee Resource Group (ERG) websites;
- Clickjacking reports against unauthenticated pages and/or static content resources;
- Reports of missing SPF records for domains with no MX record;
- Vulnerabilities that are a result of malware;
- Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, or
- Issues determined to be low impact.
- Self-XSS involving a payload in headers or in the body of the request
- Vulnerabilities which require a social engineering component are excluded. i.e. presenting injected data to a user and expecting the user to click on an external link to complete the compromise
- Login/logout CSRF
- Content spoofing which depends on a social engineering element to succeed (such as an error page suggesting that a user take an action) is excluded
- Abandoned CNAME records require a social engineering component to successfully exploit, they are excluded unless there is an existing link from a company resource to the invalid CNAME
In addition, the submitter:
- Must not be the author of the code with the vulnerability or
- Must not be employed by AT&T directly or indirectly.
Vulnerabilities that are disclosed to any party other than AT&T, including
vulnerability brokers, will not qualify for reward. This includes both public
disclosure and limited private release.
Program Terms and Conditions
The following Terms and Conditions apply to the Program:
- "AT&T" refers to AT&T Services, Inc., and its affiliates.
- You must comply with the Program and abide by the law.
- AT&T employees, contractors, and their families are not eligible for rewards.
- You must submit your report as soon as you have discovered a potential vulnerability. By submitting the vulnerability, you affirm that you have not disclosed and agree that you will not disclose the vulnerability or your submission to anyone other than AT&T following the process set forth in the Program. Absent AT&T's prior written consent, any disclosure would violate the Program. It is understood and agreed that money damages would not be a sufficient remedy for any breach of this paragraph by you or your representative(s) and that AT&T shall be entitled to specific performance as a remedy for any such breach, including injunctive relief. Such remedy shall not be deemed to be the exclusive remedy for any such breach but shall be in addition to all other remedies available at law or equity to AT&T.
- Submissions selected for rewards, and the individuals who submitted the vulnerabilities will receive recognition at the sole discretion of AT&T.
- By submitting information about a potential vulnerability, you agree to all Program Terms and Conditions and grant AT&T a worldwide, royalty-free, non-exclusive license to use your submission. Only the first submission of a given potential vulnerability that AT&T has not yet identified is eligible. In the event of a duplicate submission, only the earliest received is considered.
- Eligibility for rewards, including the determination of the recipients and reward amount is left up to the sole discretion of AT&T.
- Out of scope vulnerabilities submitted are generally less likely to receive recognition or rewards under the Program.
- You are responsible for all taxes associated with and imposed on any reward you may receive in connection with your submission. HackerOne handles all bounty payments through the HackerOne platform. Please refer to HackerOne’s relevant policies here. * You may only exploit, investigate, or target vulnerabilities against your own accounts. Testing must not violate any law, or disrupt or compromise any data or access data that is not yours; intentional access of customer data other than your own is expressly prohibited.
- If you inadvertently access customer, employee, or business related information during your testing, you must immediately notify AT&T and the information must not be used, disclosed, stored, or recorded in any way. Inadvertent access of the data must be declared within your submission.
- Your testing activities must not negatively impact AT&T, or AT&T's Environment availability or performance.
- AT&T reserves the right of non-remediation in its sole discretion.
- The Program constitutes the entire agreement and understanding of the parties with respect to the items listed herein. The Program may be amended or modified any time without notice in AT&T’s sole and absolute discretion.
- If any portion of the Program is found to be illegal or unenforceable, then the parties shall be relieved of their responsibilities arising under such portion, but only to the extent that such portion is illegal or unenforceable.
When reporting vulnerabilities, you must first register or log on to your
account on HackerOne. In describing the vulnerability it is important to
include all necessary details required for reproducing the vulnerability as
well as the tools required to reproduce the vulnerability. Please note that
the vulnerability should be treated in accordance with the terms of the
- Each submission will typically receive a reply within one (1) business day acknowledging that the report was successfully received.
- Duplicate submissions (where the vulnerability has already been reported to AT&T are not eligible for rewards. In most instances, you will not be notified of a duplicate report condition until after the vulnerability has been remediated.
- Please recognize that AT&T operates a complex Environment and the amount of time required to address a reported issue can vary from a few hours to several months. You will receive notification of the final outcome of our remediation efforts once the Program is notified by AT&T internal support team. AT&T cannot provide updates on remediation efforts that are in progress.
Only vulnerabilities will be considered for an award. Only those
vulnerabilities that have been resolved will receive an award. The bounties
range from $50 to $2,000 depending on criteria such as the type/severity of
the vulnerability, impacted domain(s), potential vulnerability exploits, and
vulnerability report submission quality. THE CRITERIA USED TO DETERMINE THE
PAYOUT FOR A VULNERABILITY IS SOLELY AT THE DISCRETION OF AT&T.
Change to Program Terms
AT&T reserves the right to discontinue the Program at any time without notice
in its sole discretion.