\n<\/p>\n
As we close out this year, we\u2019re sharing a number of updates<\/a> on our work to protect people around the world against various threats. As part of this, we\u2019re sharing some updates from our bug bounty program over the past year, a look at how we are working with external researchers to help secure our virtual reality (VR) and mixed reality metaverse technology, and new payout guidelines with bounty amounts as high as $300,000.<\/p>\n We received hundreds of impactful bug reports in 2022 from researchers all over the world that have helped to make our community more secure, and we paid out more than $2 million in bounty awards.<\/p>\n Here are some highlights from our bug bounty program:<\/b><\/p>\n This year, we prioritized further integrating our bug bounty program into our journey to the metaverse by:<\/p>\n Highlighting the Scope of Our Program: <\/strong>Today, we\u2019re updating our terms to highlight that our latest products, Meta Quest Pro and the Meta Quest Touch Pro controllers, are eligible for the bug bounty program.<\/p>\n Updating Payout Guidelines: <\/b>We\u2019re adding new payout guidelines<\/a> for VR technology<\/a>, including bugs specific to Meta Quest Pro. We\u2019re among the first bug bounty programs to set payout guidelines for VR and mixed reality devices and we will continue to update and adjust as the industry evolves.<\/p>\n Putting Our Technology in the Hands of Researchers: <\/b>Because the bug bounty space is relatively new for many, we worked this year to make our hardware technology more accessible to the researcher community so they can find and report bugs. For example, we made our VR technology a focus for our annual BountyCon conference, the industry\u2019s only regular conference for bug hunters. One of our highest-rated sessions at this year\u2019s conference was a presentation on how to hunt for bugs across our VR headsets and smart glasses. Following this session, we invited researchers to explore Meta Quest 2 devices and use them during our live hacking event.<\/p>\n One of the bugs we rewarded as part of the conference was submitted by our long-time researcher Youssef Sammouda, who reported an issue in Meta Quest\u2019s oAuth flow that could have led to a 2-click account takeover. We\u2019ve fixed this issue, our investigation has found no evidence of abuse and rewarded this report a total of $44,250, including program bonuses.<\/p>\n\n
Connecting the Bug Bounty Community With the Metaverse<\/h2>\n
New Payout Guidelines<\/b><\/h2>\n