Facebook on Monday announced two major Instagram-related updates to its bug bounty programs. The company has added Instagram to its Data Abuse Bounty program and it has launched an invitation-only program for the Checkout feature.
In April 2018, following the Cambridge Analytica scandal, Facebook announced the launch of a bug bounty program focusing on the misuse of private information. The social media giant has been offering between $500 and tens of thousands of dollars for reports of apps that collect and transfer personal data.
This program has now been expanded to include Instagram in an effort to encourage security researchers to report potential cases of abuse. Facebook says reports will be rewarded based on impact and quality.
As for the invite-only program for Checkout, Facebook has reached out to researchers who had previously sent in high quality reports to its bug bounty program.
Checkout is a feature that allows users to buy products directly from Instagram, without leaving the application. When it was announced in March, Checkout was in closed beta for businesses and available only to users in the United States.
Facebook now wants researchers to “stress test” Checkout before the feature is rolled out outside the U.S.
Facebook last year paid out $1.1 million through its bug bounty program, and a total of $7.5 million since the launch of the initiative in 2011.
“Since launching our bug bounty program in 2011, we’ve worked with the security researcher community to help us identify and fix potential issues in our products and services. This program is one of the longest-running in the industry and we’ve received thousands of bug bounty reports from researchers around the world,” Dan Gurfinkel, security engineering manager at Facebook, said on Monday.
Related: Facebook Launches Privacy and Data Use Business Hub
Related: Facebook Pays $120,000 in Bounties at BountyCon
Related: Facebook Pays Big Bounty for DoS Flaw in Fizz TLS Library

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
