AI
Snapchat’s Bug Bounty Program by the Numbers
Snapchat serves 400 million daily active users and 850 million total. The bug bounty program launched in 2015 and receives close to 1,000 submissions per year. Payouts reach $35,000 for critical bugs in the main Snapchat app and $5,000 for lower-tier assets. By 2024, Snapchat paid out over $1 million in bounties. The program attracts high volume because anyone can download the app and start testing. Internal and external triage resources handle the load so the core team can focus on root cause analysis.
Stranger Events: A Supply Chain Bug That Bypassed CVE Scanners
FSEvents is a file monitoring library pulled in transitively by most Node.js developers through nodemon, chokidar, and fsevents. It sees over 19 million weekly downloads. In April, a GitHub advisory described a remote code execution risk: older versions downloaded a binary from an S3 bucket during the build process. A researcher later claimed that S3 bucket after the original developer deleted it. AWS holds deleted bucket namespaces for three months before releasing them. The bug had no CVE, so Snapchat’s OSS scanners missed it entirely.
Cell Phone Booth: Deep Links Force Unauthorized Video Calls
A researcher submitted a video showing they could trigger a Snapchat video call without the victim accepting it. The attack requires the target to be on the attacker’s friend list. The attacker opens a conversation on Snapchat’s web client, captures the conversation ID, crafts a Snapchat deep link specifying video call type and that ID, then sends it by email or forum post. Clicking the link starts the call. The bug appeared when Snapchat launched its web client in 2022, exposing conversation IDs the mobile app had never surfaced.
Blind XSS Reaches the Jupyter Kernel
A researcher injected an XSS polyglot into Snapchat’s user agent field, waited two weeks, and received a callback. The string entered a BigQuery database as log data. A Snapchat data scientist later pulled that data and ran a report in a Jupyter notebook. Jupyter treats output from user-initiated execution as trusted. Because the IPython kernel runs locally on the analyst’s machine, XSS inside a notebook becomes a Python execution channel. A crafted payload can call the kernel directly and run arbitrary commands on the client, which a live demo confirmed.
Running and Upgrading a Bug Bounty Program
Start private and run for six to twelve months before going public. Researchers will find unexpected scope and unknown instances. Going public before you can handle volume sets a bad first impression. Snapchat’s program took 10 years to reach its current size, expanding scope and budget incrementally. For mature programs, track time-to-bounty, false positive rates, and submissions by vulnerability type. These metrics drive investment decisions. Temporary bounty boosts for under-tested assets, live hacking events, and a monthly bug-of-the-month disclosure keep researchers returning.
Notable Quotes
in general it’s already a little shady that a npm package is downloading a binary from S3 bucket so it’s already it has a lot of red flags Murali Vadakke Puthanveetil · ▶ Watch (8:03)
don’t go by the researchers severe rating because they might not have the full context of your own environment Murali Vadakke Puthanveetil · ▶ Watch (30:07)
a lot of folks think of a Buon program as a pentest as a service and that in in my opinion is a disaster Vinay Prabhushankar · ▶ Watch (32:02)
Key Takeaways
- Vulnerabilities without CVEs bypass most OSS scanners; monitor GitHub advisories and S3 bucket behavior separately.
- Blind XSS in internal data pipelines can escalate to RCE when Jupyter notebooks are in the chain.
- A privacy bug bar alongside a security bug bar helps teams correctly rate severity when incidents touch user data.
About the Speaker(s)
Vinay Prabhushankar brings over a decade of experience in the security industry, with prior roles at Microsoft and Splunk. He runs the Bug Bounty program for Snapchat and leads their M&A Security program. He has presented at Bluehat, LASCON, and BSides Las Vegas.
Murali Vadakke Puthanveetil is a Security Lead at Snap Inc., focused on securing M&As and defining a security trust center. He has over a decade of experience in application security domains including authentication, web application design, FIDO2, and WebAuthn.