Instagram Vulnerability Disclosure

generated: '2026-08-29'
method: searched
source: https://bugbounty.meta.com/
program:
  name: Meta Bug Bounty
  operator: Meta Platforms, Inc.
  self_hosted: true
  platform: self-hosted (bugbounty.meta.com), not HackerOne/Bugcrowd/Intigriti
  url: https://bugbounty.meta.com/
  report_url: https://www.bugbounty.meta.com/report/
  in_scope_products:
  - Facebook
  - Messenger
  - Instagram
  - WhatsApp
  - Workplace
  - Meta Quest
  - Ray-Ban Stories
  - Meta AI
  - Meta open source projects
  scope_url: https://www.bugbounty.meta.com/scope/
  payout_guidelines_url: https://www.bugbounty.meta.com/payout-guidelines/
  data_abuse_policy_url: https://www.bugbounty.meta.com/data-abuse/
  researcher_program_url: https://www.bugbounty.meta.com/hackerplus/
  max_reward: USD 300,000 (mobile remote code execution)
  paid: true
security_txt:
  served: false
  probed:
  - url: https://www.instagram.com/.well-known/security.txt
    status: 200
    note: SPA catch-all HTML shell, not an RFC 9116 document.
  - url: https://www.facebook.com/.well-known/security.txt
    status: 400
  - url: https://developers.facebook.com/.well-known/security.txt
    status: 404
  - url: https://graph.instagram.com/.well-known/security.txt
    status: 400
  note: >-
    Meta serves no RFC 9116 security.txt on any probed host. Disclosure is routed entirely through
    the bugbounty.meta.com intake form, which is the discoverable channel a researcher is expected
    to use. This is a real gap in machine-discoverable disclosure metadata for an otherwise mature
    program.
evidence:
- url: https://bugbounty.meta.com/
  status: 200
  fetched: '2026-08-29'
  finding: >-
    Program page names Instagram explicitly among in-scope products and links the report intake,
    scope, payout guidelines and data-abuse policy.