Home Make Money Online How to make money on facebook by reporting bugs in 2023

How to make money on facebook by reporting bugs in 2023

facebook bug


Facebook is primarily a social network; an online place where people can hang out, socialize and share things of common interest. This is one of the reasons why it can be vuneral, you know we are all humans and we aint perfect no matter how brilliant we are.

and you wont be suprised if i told you that some people earn a living reporting bugs on websites and social platforms(usually called white hackers)

you can make 500-5000$ a day by reporting bugs, smart way to make money online right?

Many major websites offer bug bounty, a lucrative deal, wherein individuals can receive credit and rewards for reporting bugs, particularly those pertaining to exploitation and vulnerabilities. Such programs help the software developers to find out and resolve bugs before the common users get aware of them, avoiding events of widespread maltreatment. Bug bounty programs have been employed by major web platforms like Facebook, Yahoo!, Google etc. Indian ethical hackers top the list when it comes to discovering and reporting bugs. In addition, they are also ranked on top of the list when it comes to being the highly paid ones from the companies.

but in this article we will be focusing on how to make money reporting bugs on facebook

Anand Prakash (Flipkart employee), Bengaluru-based hacker, discovered and reported a crucial error in Facebook’s log-in system that could have been exploited by wrongdoers to easily penetrate other user’s Facebook account. Anand Prakash was rewarded $15,000 as an appreciation for enlightening the vulnerability. At present, he has almost earned over 1 crore by testing Facebook and Google for bugs.

while Before Jani even reached the age eligibility to create a Facebook account, he discovered a major flaw in Instagram, earning him $10,000 from Facebook when he was just 10. Jani discovered a way to penetrate Instagram’s servers and remove text posted by Instagram users.

10 powerful Facebook Ad Examples in 2023

facebook bug

you can report a bug on facebook by reading here If you believe that you have found a security vulnerability on Facebook (or on another member of the Facebook family of companies), we encourage you to let us know straight away. We will investigate all legitimate reports and do our best to quickly fix the problem. Before reporting though, please review this page, including our responsible disclosure policy, reward guidelines and things that should not be reported.

If you are looking to report another type of issue, please use the links below for assistance.

Responsible disclosure policy

If you comply with the policies below when reporting a security issue to Facebook, we will not initiate a lawsuit or law enforcement investigation against you in response to your report. We ask that:

  • You give us reasonable time to investigate and mitigate an issue that you report before making any information about the report public or sharing such information with others.
  • You do not interact with an individual account (which includes modifying or accessing data from the account) if the account owner has not consented to such actions.
  • You make a good faith effort to avoid privacy violations and disruptions to others, including (but not limited to) unauthorised access to or destruction of data, and interruption or degradation of our services.
  • You do not exploit a security issue that you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.)
  • You do not intentionally violate any other applicable laws or regulations, including (but not limited to) laws and regulations prohibiting the unauthorised access to data.
  • For the purposes of this policy, you are not authorised to access user data or company data, including (but not limited to) personally identifiable information and data relating to an identified or identifiable natural person.

also read How do bloggers get paid? – 5 ways to make money as a blogger

Bug bounty programme terms

We recognise and reward security researchers who help us to keep people safe by reporting vulnerabilities in our services. Monetary bounties for such reports are entirely at Facebook’s discretion, based on risk, impact and other factors. To potentially qualify for a bounty, you first need to meet the following requirements:

  • Adhere to our responsible disclosure policy (see above).
  • Report a security bug: identify a vulnerability in our services or infrastructure which creates a security or privacy risk. (Note that Facebook ultimately determines the risk of an issue, and that many software bugs are not security issues.)
  • Your report must describe a problem involving one of the products or services listed under “Bug bounty programme scope” (see below).
  • We specifically exclude certain types of potential security issues; these are listed under “Out of scope and false positives” (see below).
  • Submit your report via our “Report a security vulnerability” form (one issue per report) and respond to the report with any updates. Please do not contact employees directly or through other channels about a report.
  • If you inadvertently cause a privacy violation or disruption (such as accessing account data, service configurations or other confidential information) while investigating an issue, you must disclose this in your report.
  • Use test accounts when investigating issues. If you cannot reproduce an issue with a test account, you can use a real account (except for automated testing). Do not interact with other accounts without consent (e.g. do not test against Mark Zuckerberg’s account).

In turn, we will follow these guidelines when evaluating reports under our bug bounty programme:

  • We investigate and respond to all valid reports. Due to the volume of reports that we receive, however, we prioritise evaluations based on risk and other factors, and it may take some time before you receive a reply.
  • We determine bounty amounts based on a variety of factors, including (but not limited to) impact, ease of exploitation and quality of the report. If we pay a bounty, the minimum reward is USD 500. Note that extremely low-risk issues may not qualify for a bounty at all.
  • We aim to pay similar amounts for similar issues, but bounty amounts and qualifying issues may change over time. Past rewards do not necessarily guarantee similar results in the future.
  • In the event of duplicate reports, we award a bounty to the first person to submit an issue. (Facebook determines duplicates and may not share details on the other reports.) A given bounty is only paid to one individual.
  • You may donate a bounty to a recognised charity (subject to approval by Facebook) and we double bounty amounts that are donated in this way.
  • We reserve the right to publish reports (and accompanying updates).
  • We publish a list of researchers who have submitted valid security reports. You must receive a bounty to be eligible to be included in this list, but your participation is then optional. We reserve the right to limit or modify the information accompanying your name in the list.
  • We verify that all bounty awards are permitted by applicable laws, including (but not limited to) US trade sanctions and economic restrictions.
From time to time, Facebook may offer promotions in connection with the Bug bounty programme. Reports submitted according to these terms may be subject to additional governing rules for that promotion as described in those rules, which are or will be made available here and are incorporated into these terms through this reference: https://www.facebook.com/whitehat/promotion/.
Note that your use of Facebook services and the services of any member of the Facebook family of companies, including for the purposes of this programme, is subject to Facebook’s Terms and Policies and the terms and policies of any member of the Facebook family of companies whose services you use. We (and any member of the Facebook family of companies that is the subject of your report) may retain any communications about security issues that you report for as long as we deem necessary for programme purposes, and we may cancel or modify this programme at any time.

Bug bounty programme scope

To qualify for a bounty, report a security bug in Facebook or one of the following qualifying products or acquisitions:

  • Instagram
  • Internet.org/Free Basics
  • Oculus
  • Onavo
  • Open source projects by Facebook (e.g. osquery)
  • WhatsApp

also read 6 ways to promote your small business on Facebook

Note that services not owned by Facebook (e.g. WordPress VIP and Page.ly) are not eligible under our bug bounty programme. While we often care about vulnerabilities affecting services that we use, we cannot guarantee that our disclosure policies apply to services from other companies.
Please also note that vulnerabilities in third-party apps or websites that integrate with Facebook (including most pages on apps.facebook.com) are generally not within the scope of our bug bounty programme. Currently, the only exception is for security bugs resulting in the exposure of Facebook user access tokens to unauthorised entities. We will accept reports of such vulnerabilities, but only if the bug is discovered by passively viewing the data sent to or from your device while using the app or website. You are not permitted to manipulate any request sent to the app or website from your device or otherwise interfere with the ordinary functioning of the app or website in connection with submitting your report. (For example, SQLi, XSS, open redirect or permission-bypass vulnerabilities (such as IDOR) are strictly out of scope.) Furthermore, you may not access data or use any access token from any Facebook account other than your own. Finally, only third-party apps with at least 50,000 active users are within scope.

Specific examples of programme scope

If you are unsure whether a service is eligible for a bounty or not, please feel free to ask us. Below are some specific examples of eligible and ineligible apps and websites to help guide your research.

Out of scope

  • Spam or social engineering techniques.
  • Denial-of-service attacks.
  • Content injection. Posting content on Facebook is a core feature, and content injection (also “content spoofing” or “HTML injection”) is ineligible unless you can clearly demonstrate a significant risk.
  • Security issues in third-party apps or websites that integrate with Facebook (including most pages on apps.facebook.com), except in the specific circumstances described in “Bug bounty programme scope” (see above).
  • Executing scripts on sandboxed domains (such as fbrell.com or fbsbx.com). Using alert (document.domain) can help verify whether the context is actually *.facebook.com.

False positives

  • Open redirects. Any redirect using our “linkshim” system is not an open redirect (learn more).
  • Profile pictures available publicly. Your current profile picture is always public (regardless of size or resolution).
  • Note that public information also includes your username, ID, name, current cover photo, gender and anything that you’ve shared publicly (learn more).
  • Sending messages to anyone on Facebook (learn more).
  • Accessing photos via raw image URLs from our CDN (Content Delivery Network). One of our engineers has posted a more detailed explanation (external link).
  • Non-case-sensitive passwords. We accept the “caps lock” version of a password or a password with the first character capitalised to avoid login problems.
  • Missing attribution on page posts. We generally show page admins which admin created a post, but this is not a security control.


Leave a Reply