Apple paid a researcher $100K for reporting a flaw in “Sign in with Apple” in April that could have let attackers hijack any user's account on third-party apps
Apple recently paid Indian vulnerability researcher Bhavuk Jain a huge $100,000 bug bounty for reporting …
Context & Ripple Effects
This $100K payout is the first high-profile proof point of the bounty program Apple rebuilt after starting small: what began as an invite-only program with a few dozen researchers was expanded in 2019 to cover macOS, watchOS, and TVOS with a $1M maximum payout and open enrollment.
The Sign in with Apple flaw matters because it sits on Apple's identity layer rather than a single device — a bug there exposed every third-party app account that relies on Apple login. Months later, a research team reported finding 55 vulnerabilities for ~$288K under the same program, confirming this was not a one-off.
First-order effects
- Apple patched a flaw that could have let attackers take over any user's account on third-party apps using Sign in with Apple, paying Bhavuk Jain $100K for the report.
- Third-party developers who had adopted Sign in with Apple as their login option were relying on a trust chain that briefly had a single-point-of-failure vulnerability at its root.
Second-order effects
- The payout validates Apple's 2019 decision to open the program broadly and raise caps: researchers like Jain now treat Apple targets as economically worth deep auditing, drawing talent that previously went to Google and Microsoft programs.
- Every app that integrated Sign in with Apple gains a security dependency on Apple's own patch cadence, pushing federated-login providers across the industry to harden their token-issuance paths against similar takeover bugs.
Third-order effects
- If the pattern holds — from invite-only in 2016 to $1M caps in 2019 to ~$20M cumulative awards including twenty $100K+ payouts by late 2022 per Apple's own accounting — external security researchers become standing infrastructure for platform vendors, not ad-hoc responders.
- Identity services are becoming the highest-stakes attack surface for ecosystems: one flaw in a sign-in provider propagates to every downstream app, which argues for treating login providers like regulated critical infrastructure over time.
The trend: Bug bounties are maturing from PR gestures into core outsourced QA for platform vendors, with identity layers emerging as the most valuable — and most dangerous — target class.