Facebook expands its bug bounty program to include third-party apps and services that involve improper exposure of Facebook user access tokens
Lily Hay Newman / Wired :
Context & Ripple Effects
Six months after launching the Data Abuse Bounty for app developers misusing platform data, Facebook is widening its external-security net again — this time paying researchers who find Facebook user access tokens improperly exposed by third-party apps and services. The move effectively deputizes outside hunters to police the app ecosystem's handling of Facebook credentials, not just Facebook's own code.
It set the template for what followed: payouts roughly doubled year over year into 2019 (about $2.2M across 1,300 accepted reports), a Hacker Plus loyalty tier was added to retain top hunters, and Facebook eventually codified a formal policy of notifying third-party developers of critical bugs it finds in their systems.
First-order effects
- Bug hunters gain a paid lane for reporting token exposure in third-party apps, meaning insecure integrations now surface to Facebook faster than they would through the developers' own channels.
Second-order effects
- Third-party developers face direct financial incentive against them: any exposed access token in their stack is now a reportable, monetizable finding, pushing them toward tighter credential handling or risk public disclosure via Facebook.
Third-order effects
- If the pattern holds, platform owners increasingly treat their developer ecosystems as part of their own attack surface — governing third-party security through bounties and disclosure policies rather than contracts alone.
The trend: Platform companies are extending bug bounty programs beyond their own code into third-party ecosystems, making external researchers a standing enforcement layer over developer security.