Security Experts:

Connect with us

Hi, what are you looking for?


Management & Strategy

Microsoft Launches ElectionGuard Bug Bounty Program

Microsoft launches ElectionGuard Bounty program

Microsoft last week announced the launch of a new bug bounty program covering the ElectionGuard open source software development kit (SDK).

Microsoft launches ElectionGuard Bounty program

Microsoft last week announced the launch of a new bug bounty program covering the ElectionGuard open source software development kit (SDK).

The ElectionGuard SDK, which Microsoft released in May 2019, is designed to make voting more secure, transparent and accessible. The system ensures that votes are encrypted and kept secure, while allowing third-party organizations to validate results and enabling voters to confirm their votes were counted correctly.

As part of the new ElectionGuard Bounty program, Microsoft is offering between $500 and $15,000 for vulnerabilities in the ElectionGuard specification and documentation, the verifier reference implementation, and the ElectionGuard API SDK.

Microsoft is specifically looking for security flaws that can be used to discover votes or secret keys, make invalid proofs look valid, and trick the reference verifier.

The highest rewards, up to $15,000, are offered for privilege escalation and information disclosure vulnerabilities, followed by security design flaws ($8,000), spoofing or tampering issues ($3,000), and remote denial-of-service attack methods ($3,000).

“Microsoft strongly believes close partnerships with researchers make customers more secure,” Jarek Stanley, senior program manager at MSRC,  said in a blog post. “Security researchers play an integral role in the ecosystem by discovering and reporting vulnerabilities to Microsoft through coordinated vulnerability disclosure. Security researchers have repeatedly demonstrated that working together helps protect customers and each year we partner together to better protect billions of customers worldwide.”

Microsoft said it paid out $4.4 million through 11 bug bounty programs between July 1, 2018 and June 30, 2019. The highest reward was $200,000.

Related: Microsoft Launches Bug Bounty Program for Dynamics 365

Related: Microsoft Offers Up to $300,000 in New Azure Security Lab

Related: Microsoft Paid $2,000,000 in Bounty Rewards in 2018

Related: Microsoft Offers Up to $30,000 for Flaws in Chromium-Based Edge

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Twenty-one cybersecurity-related M&A deals were announced in December 2022.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.