protonvpn bug bounty

As with Proton Mail, we have built Proton VPN with an emphasis on security. Today, we are launching a Bug Bounty Program to further enhance Proton VPN’s security.

In operating a VPN service, security is required not only for the VPN connections and protocols themselves. Security is also needed for the underlying server infrastructure, the web pages and dashboards, the VPN applications themselves, the payment system, and also the user databases. To properly protect user privacy, we need to protect all aspects of the service from compromise.

In building Proton VPN, we drew upon the security expertise we have gained from running the world’s largest secure email service(new window). We have also been working together with Proton Mail security contributors(new window) and the broader community on strengthening all aspects of Proton VPN. Recently, we worked together with long time Proton Mail security contributor Mazin Ahmed(new window) to complete a comprehensive security audit of Proton VPN and add additional hardening.

Our bug bounty program allows us to extend the work that we already do on a daily basis to protect Proton VPN users. For this reason, now that Proton VPN has officially launched, one of the first things we are doing is launching the Proton VPN Bug Bounty Program. With this program, we are inviting security experts from around the world to try to find weaknesses within Proton VPN, and we will be paying rewards (bounties) for security issues which are reported to us through this program. If you are a security researcher, you can also participate in the Proton Mail Bug Bounty Program(new window).

Proton VPN Bug Bounty Program


Scope: The program is limited to the servers and the web, desktop and mobile applications run by Proton VPN. Our profiles on Facebook, Twitter, Linkedin, Eventbrite, etc, do not qualify. Qualifying sites include:

  • [Note: .ch and not .com]

The Proton VPN applications on Windows, MacOS, Linux, iOS and Android are also included in this program.

Judging: The judging panel to determine awards consists of Proton VPN and Proton Mail developers assisted by one or more outside experts who are part of our security group. Program participants agree to respect the final decision made by the judges.

Responsible Disclosure: We request that all vulnerabilities be reported to us at We believe it is against the spirit of this program to disclose the flaw to third parties for purposes other than actually fixing the bug. Participants agree to not disclose bugs found until after they have been fixed and to coordinate disclosure with our team through our release notes to avoid confusion.

Responsible Testing: Please do not hack user accounts, corrupt databases, or leak data that might be sensitive. We also discourage vulnerability testing that degrades the quality of service for our users. If in doubt, feel free to contact our Security Team at

Adherence to Rules: By participating in this program, you agree to adhere to the above rules and conditions. All rules must be followed to be eligible for awards.

Qualifying vulnerabilities

Any design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be in scope for the program. This includes, but is not limited to:

Web Applications

  • Cross-site scripting
  • Cross-site request forgery
  • Mixed-content scripts
  • Authentication or authorization flaws
  • Server-side code execution bugs
  • REST API vulnerabilities


  • Un-authorised shell access
  • Privilege escalation
  • Remote code execution


  • Authentication or authorization flaws
  • Local data security breach (without rooting)

We believe in working closely with security researchers and are willing to share technical details such as API specifications, source code, or infrastructure details with selected researchers with the aim of improving security for all Proton Mail users. Please contact for more details.

Qualifying Improvements

Sometimes, bounties are awarded for suggestions for improvement which don’t fall into any of the above categories. This is determined on a case by case basis by our team. These include things such as:

  • Server configuration improvements
  • Firewall configurations
  • Improved DoS/DDoS safeguards
  • Path/information disclosure

Non-Qualifying vulnerabilities

  • Flaws impacting out of date browsers (sorry, IE6 security issues don’t qualify)
  • Security issues outside the scope of Proton VPN’s threat model
  • Phishing(new window) or social engineering attacks
  • Bugs requiring exceedingly unlikely user interactions
  • WordPress bugs (but please report those to WordPress)
  • Out of date software – For a variety of reasons, we do not always run the most recent software versions, but we do run software that is fully patched
  • Software bugs in OpenVPN or IKEv2 (but please report them to their authors)

Reward Amounts

The size of the bounty we pay is determined on a case by case basis and largely depends on the severity of the issue. To be awarded a bounty, you usually need to be the first person to report an issue, although sometimes exceptions are made. Rough bounty guidelines are provided below:

Minor server and app vulnerabilities that do not compromise user data or privacy: $50
Vulnerabilities that can lead to data corruption: $200
Vulnerabilities that can lead to the disclosure of user data or jeopardize user privacy: $1,000+
Maximum bounty: $10,000

Reporting Guidelines

Please report issues to Issues should be reported with clear instructions on how to reproduce the issue and/or proof of concept.

Best Regards,
The Proton Team

Protect your privacy and security online
Get Proton VPN free

Related articles

What is AirTag stalking?
In an era of “smart devices” that often double as spy devices, AirTags are tracking tools that are open about their function and can be vital in helping locate lost items (as anyone who has lost their car keys can attest to). However, as a recent cla
How to fix a "Your connection is not safe" error
As you surf the web using your browser, you’ll no doubt encounter websites that your browser will refuse to load, instead showing some variation of an error message, such as Your connection is not private or Warning: Potential Security Risk Ahead. 
Your search history is a window into your inner life. Anyone with access to it knows what your hobbies and interests are, your sexual orientation and preferences, the things that worry you (for example your medical concerns), your political affiliati
how to flush dns blog
  • Privacy deep dives
A DNS cache is a record of all the websites you’ve visited over a set amount of time. Simply put, your DNS cache is a list of websites you visited in the past that’s stored on your device. Your computer uses it to speed up visits to those same websit
Is Temu legit?
  • Privacy basics
Temu has become an unavoidable brand. Unknown to most up to a year ago, the online retailer exploded onto the digital scene in the United States with lavish ads and a riveting social media campaign, and has started its takeover in Europe now, too. As
We examIne whether the controversial Chinese video platform is safe to use
  • Privacy basics
In this article, we take an in-depth look at whether the wildly popular social media platform TikTok is safe to use. Several countries recently banned government officials from using TikTok, and now the US House of Representatives has passed the Pro