Researchers who discovered and responsibly disclosed vulnerabilities in Facebook last year were awarded a total of $1.3 million, the social media giant said on Wednesday.
Since it launched its bug bounty program almost four years ago, Facebook paid out more than $3 million to experts who contributed to making the service more secure. In 2014, the number of submissions was 17.011, which represents a 16% increase compared to the previous year.
A total of 321 researchers from 65 countries were rewarded last year, with an average bug bounty of $1,788. Of the total of $1.3 million, more than $250,000 went to the top five earners. Security experts reported a total of 61 eligible high-severity bugs, 49% more than in 2013, Facebook said.
It’s worth noting that while the number of submissions increased, the total amount of money paid out in 2014 is lower compared to 2013, when Facebook handed out $1.5 million.
The largest number of valid submissions came from India (196), followed by Egypt (81), the United States (61), the United Kingdom (28), and the Philippines (27). Facebook has pointed out that the UK earned the highest amount per report with an average of $2,768.
The bug spotlight for 2014 includes vulnerabilities related to hidden input parameters, Amazon S3 buckets ($6,500 reward), and legacy REST API calls ($20,000 reward).
“We’re excited to see what 2015 holds for the bug bounty program. Report volume is at its highest levels, and researchers are finding better bugs than ever before. We’ve already received more than 100 valid reports since the start of the new year,” Facebook security engineer Collin Greene wrote in a blog post.
Laxman Muthiyah is one of the researchers who reported vulnerabilities this year. Earlier this month, the expert published the details of a Graph API bug that allowed attackers to delete users’ photos. Muthiyah was awarded a $12,500 bounty for his work.
