Facebook Lead Ads Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://bugbounty.meta.com/
note: >-
  Meta runs one of the longest-standing vulnerability disclosure programs on the internet,
  and it covers Facebook — and therefore the Graph API surface Facebook Lead Ads sits on.
  It is NOT advertised via RFC 9116: /.well-known/security.txt is absent from every host
  this product uses (404 on developers.facebook.com, 400 on www.facebook.com and
  graph.facebook.com), so an automated scanner following the standard discovery path finds
  nothing. That gap is the finding; the program itself is real and was read directly.
program:
  name: Meta Bug Bounty
  url: https://bugbounty.meta.com/
  type: bug-bounty
  self_hosted: true
  platform: Meta's own researcher portal (not HackerOne / Bugcrowd / Intigriti)
policy:
  - https://bugbounty.meta.com/
statement: >-
  "If you believe you have found a security vulnerability on Meta (or another member of the
  Meta family of companies), we encourage you to let us know right away."
scope:
  - Facebook
  - Messenger
  - Instagram
  - WhatsApp
  - Workplace
  - Meta Quest
  - Ray-Ban Stories
  - Meta AI
  - Meta open source projects
rewards:
  minimum: USD 500
  maximum: USD 300000
  maximum_category: Mobile RCE
  bonus_program: Hacker Plus — up to 30% on top of the base bounty
  statement: '"We pay based on maximum security impact found internally."'
reporting:
  method: Submit a report through the Meta Bug Bounty portal.
  url: https://bugbounty.meta.com/
security_txt:
  served: false
  probed:
    - {url: 'https://developers.facebook.com/.well-known/security.txt', status: 404}
    - {url: 'https://www.facebook.com/.well-known/security.txt', status: 400}
    - {url: 'https://graph.facebook.com/.well-known/security.txt', status: 400}
  finding: >-
    No RFC 9116 security.txt on any host. The disclosure program is discoverable only by
    knowing the bugbounty.meta.com hostname.
evidence:
  - source: https://bugbounty.meta.com/
    kind: disclosure-program-page
    fetched: '2026-08-14'
    http_status: 200
    keywords: [bug bounty, security vulnerability, responsible disclosure, Hacker Plus]