Security researchers say Apple's bug bounty program is undermined by Apple's insular culture, confusion about payments, and long delays in fixing bugs
Reed Albergotti / Washington Post :
Context & Ripple Effects
Apple launched its bug bounty in 2016 as a narrow program focused on high-quality exploits for a few key areas of iOS and iCloud, promising it would grow over time (that initial rollout was received as a good start). Coverage since then has tracked the friction: by 2017 researchers already called it a slow start, complaining rewards were too small and that reporting bugs could interfere with their own research (those interviews foreshadowed today's story).
The counterweight appeared in October 2020, when one research group detailed finding 55 vulnerabilities in three months under the program and receiving roughly $288K so far (that payout account) — proof the pipeline works when it works. The new Washington Post reporting, from Reed Albergotti, explains why many researchers still don't trust it: an insular security culture, confusing payments, and long delays before fixes ship.
First-order effects
- Researchers weighing whether to report iOS flaws now face a documented track record of slow fixes and payment confusion, pushing them to sit on findings or sell them rather than disclose through Apple.
Second-order effects
- Exploit brokers and rivals with faster-paying bounty programs gain a supply advantage: every delayed Apple fix widens the market for undisclosed iOS vulnerabilities.
Third-order effects
- If Apple doesn't restructure the program, its security posture risks depending on internal discovery alone while the external research economy consolidates around platforms that pay promptly and patch fast — a structural test of whether closed cultures can sustain open vulnerability markets.
The trend: Platform security is shifting from closed, company-controlled bug handling to competitive external researcher economies, where payment speed and fix cadence determine who gets vulnerabilities disclosed first.