The ExpressVPN bug bounty reward has increased to US$100,000, the company announced on Tuesday. This is the highest single bounty offered on the Bugcrowd platform and 10 times higher than the top reward previously offered by ExpressVPN.
ExpressVPN Bug Bounty
ExpressVPN announced it is offering US$100,000 via Bugcrowd’s Bug Bounty solution to researchers who can find and demonstrate a critical security bug on ExpressVPN’s in-house technology, TrustedServer. It is the highest single bounty offered on the Bugcrowd platform and 10 times higher than the top reward previously offered by ExpressVPN, showcasing the company’s commitment to providing essential privacy protections to its users.
ExpressVPN built TrustedServer technology to significantly minimize problems that traditional server management pose. On top of having an independent audit by PwC to confirm TrustedServer’s security-enhancing claims, ExpressVPN is taking a further step by rewarding the people who help them improve their security.
ExpressVPN is inviting Bugcrowd security researchers to test the following types of security issues within its VPN servers:
- unauthorized access to a VPN server or remote code execution
- vulnerabilities in ExpressVPN’s VPN server that result in leaking the real IP addresses of clients or the ability to monitor user traffic
Details
To participate in the bug bounty head to https://www.expressvpn.com/bug-bounty.
- The first person to submit a valid vulnerability, granting unauthorized access or exposing customer data, will receive the US$100,000 bounty. This one-time bonus is valid until the prize has been claimed.
- The one-time US$100,000 bounty is only eligible for vulnerabilities in ExpressVPN’s VPN Server
- Activities should remain in scope to the TrustedServer platform. If unsure that your testing is considered in-scope, please reach out to [email protected] to confirm first.
Nick McKenzie, Chief Information & Security Officer, Bugcrowd, says,
We’re uber excited to see a leader in the online privacy and security world stepping up collaborating with our community of cyber researchers, to ultimately work together to ensure a safe online experience for everyone. ExpressVPN’s ongoing partnership with Bugcrowd since 2020 demonstrates its commitment to a strong security posture and a constant drive to improve the security of its products and services. We hope this incentivizes more researchers to join the crowd, and be a part of finding solutions to secure the digitally connected world.
ExpressVPN has had a Bug Bounty program since 2016, and was one of the first in the industry to implement one. The company has since paid out tens of thousands of dollars to security researchers, joining Bugcrowd in 2020 to increase the reach and effectiveness of its program.