OpenAI, the company behind ChatGPT, has announced its Bug Bounty Program. The OpenAI Bug Bounty Program is designed to incentivize individuals or groups to discover and report security vulnerabilities or bugs in OpenAI’s software systems, applications, or infrastructure.
The program offers monetary rewards for discovering and reporting security flaws or bugs in OpenAI’s systems to help ensure the security and integrity of OpenAI’s technology and protect its users’ data. It is offering $200 – $6,500 per vulnerability, with a maximum reward of $20,000.
According to the company, it has rewarded 14 vulnerabilities as at the time of this report. The average payout in the last three months is $1,287.50. It claims that validation is done within about 2 hours; 75% of submissions are accepted or rejected within about 2 hours.
Rules of Engagement
To help us distinguish between good-faith hacking and malicious attacks, you must follow these rules:
- You are authorized to perform testing in compliance with this policy.
- Follow this policy and any other relevant agreements. In case of inconsistency, this policy takes precedence.
- Promptly report discovered vulnerabilities.
- Refrain from violating privacy, disrupting systems, destroying data, or harming user experience.
- Use OpenAI’s Bugcrowd program for vulnerability-related communication.
- Keep vulnerability details confidential until authorized for release by OpenAI’s security team, which aims to provide authorization within 90 days of report receipt.
- Test only in-scope systems and respect out-of-scope systems.
- Do not access, modify, or use data belonging to others, including confidential OpenAI data. If a vulnerability exposes such data, stop testing, submit a report immediately, and delete all copies of the information.
- Interact only with your own accounts, unless authorized by OpenAI.
- Disclosure of vulnerabilities to OpenAI must be unconditional. Do not engage in extortion, threats, or other tactics to elicit a response under duress. OpenAI denies Safe Harbor for vulnerability disclosure conducted under such circumstances.
The Scope of the bug bounty program includes the following:
- API Targets
- ChatGPT
- Third Party Corporate Targets
- OpenAI API Keys
- OpenAI Research Org
- Other OpenAI Targets including OpenAI.com website, OpenAI Developer Documentation, Developer playground, any other Internet-facing infrastructure operated by OpenAI and not specified in another target and any other public cloud resources or infrastructure operated by OpenAI.
OpenAI welcomes people to report vulnerabilities, bugs, or security flaws they discover in their systems. “By sharing your findings, you will play a crucial role in making our technology safer for everyone.”
