{"id":"fd49b343-a058-4718-9b7b-dbb3199dc555","engagementId":"fb3f327b-e94b-479e-b9ca-c5978bc08587","data":{"brief":{"id":"32d373b6-596e-4424-ba4a-4679de9f6f76","name":"Tesla","tagline":"Accelerating the world’s transition to sustainable energy","description":"\u003ch1\u003eOverview\u003c/h1\u003e\n\n\u003cp\u003eTesla values the work done by security researchers in improving the security of our products and service offerings. We are committed to working with this community to verify, reproduce, and respond to legitimate reported vulnerabilities. We encourage the community to participate in our responsible reporting process. We will coordinate and communicate with researchers through the bug bounty process.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eFor vehicle or energy products\u003c/strong\u003e\u003cbr\u003e\nWhile we use Bugcrowd as a platform for rewarding all issues, please report vehicle and product related issues directly to vulnerabilityreporting@tesla.com, using our GPG key to encrypt reports containing sensitive information.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eThird-party bugs\u003c/strong\u003e\u003cbr\u003e\nIf issues reported to our bug bounty program affect a third-party library, external project, or another vendor, Tesla reserves the right to forward details of the issue to that party without notification to the researcher.\u003c/p\u003e\n\n\u003ch3\u003eEligibility\u003c/h3\u003e\n\n\u003cp\u003eNote, Tesla's bug bounty program is in part facilitated through a third party (BugCrowd) who performs additional services and eligibility checks on our behalf. For example, Tesla may not issue payments if one or more of the following is applicable:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cp\u003eYou are a resident of a country under U.S. sanctions or live in a country that prohibits this type of program,\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are under the age of 14 at the time of reporting, or between the age of 14 and 18 without explicit prior permission from a parent or guardian.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou are currently (or were in the last 6 months) an employee of Tesla, a Tesla subsidiary, or third-party contractor with access to Tesla’s internal systems and networks.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eHow the program works\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eSecurity researchers and Tesla customers are encouraged to submit reports regarding the security measures used to protect Tesla products and services.\u003c/li\u003e\n\u003cli\u003eWhen conducting security research, you are required to follow Responsible Disclosure Guidelines \u0026amp; Tesla’s Rules of Engagement (referred to as “Terms”), which are provided below.\u003c/li\u003e\n\u003cli\u003eIf a vulnerability is found, please document your findings thoroughly before sending them to us. This may include screenshots or videos of your findings.\u003c/li\u003e\n\u003cli\u003eMembers of Tesla’s team may contact you to confirm that we have received your submission, ask questions about your findings, and discuss how to reproduce them.\u003c/li\u003e\n\u003cli\u003eTesla may direct you to stop your activities in the event that your research impacts Tesla owned assets, Tesla vendors, or other customers. If directed to stop, you must immediately comply with the request.\u003c/li\u003e\n\u003cli\u003eTesla’s security team will then work with impacted business units to validate the findings.\u003c/li\u003e\n\u003cli\u003eIf Tesla can validate your findings and we determine that it is eligible for a reward under this program’s Terms, a bounty reward will be issued.\u003c/li\u003e\n\u003cli\u003eYou are responsible for the payment of all applicable taxes.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003eTERMS\u003c/h1\u003e\n\n\u003ch3\u003eResponsible Disclosure Guidelines\u003c/h3\u003e\n\n\u003cp\u003eWe will investigate legitimate reports and make every effort to quickly correct any vulnerability. To encourage responsible reporting, we will not take legal action against you nor ask law enforcement to investigate you, so long as you comply with the Terms.\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eDo not access or modify data that does not belong to you\u003c/strong\u003e. If you are able to gain access to or modify data that belongs to Tesla, other customers, or Tesla vendors during the course of your research, you must take the following actions:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eImmediately stop your activities,\u003c/li\u003e\n\u003cli\u003eDisclose your findings to Tesla as soon as possible (but no later than 24 hours after discovery). Your findings should include details of the vulnerability, including information needed to reproduce and validate the vulnerability and a Proof of Concept (POC),\u003c/li\u003e\n\u003cli\u003eWait for further instruction from the Tesla team.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eMake a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eGive Tesla a reasonable time to correct the issue before making any information public. In certain circumstances, Tesla may request that you not disclose your findings or to delay disclosure until we can ensure that the matter has been adequately addressed. You may not disclose confirmed, unresolved vulnerabilities without approval from Tesla.\u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003ch3\u003eRules of Engagement\u003c/h3\u003e\n\n\u003col\u003e\n\u003cli\u003e\u003cp\u003eResearch must be done using your own account or Tesla products that you own. You should not intentionally modify online accounts, data or products owned by other Tesla customers (without explicit permission). If during the course of your research, you find a vulnerability that would allow you to bypass an authentication control for another person’s account, you should report the vulnerability to Tesla immediately and take no further action.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eIf you are able to access or modify personal data of other customers or other sensitive data that does not belong to you, immediately contact Tesla. Do not attempt to conduct post-exploitation work with this data.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eWhere you are able to access data that does not belong to you, you will be asked to delete it. You must comply with this request, demonstrate the steps you took to ensure it was deleted, and confirm deletion to Tesla in order to be eligible for a reward.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDo not attempt to use brute force or denial of service attacks on Tesla-owned systems without prior written approval.\u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003ch3\u003eHardware Research Registration\u003c/h3\u003e\n\n\u003col\u003e\n\u003cli\u003e\u003cp\u003eHardware Research Registration: If you are performing good-faith bug bounty related research on hardware that you own (vehicles or Powerwall, for example), you must first register the hardware with Tesla via vulnerabilityreporting@tesla.com.\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eThis is necessary to prevent warranty-related issues. Registering also permits Tesla to voluntarily support researchers by providing updates or a “reflash” of the researcher-owned vehicle or Powerwall.\u003c/p\u003e\u003c/li\u003e\n\u003c/ol\u003e","industryTagId":"84de63c9-6091-4b30-a36e-d55632cb0f0b","targetsOverview":"\u003cp\u003e \u003cbr\u003e\nWhen registering for an account, please use your username@bugcrowdninja.com email address. Please refrain from spamming forms (order forms, contact forms, etc) with high numbers of requests.\u003c/p\u003e\n\n\u003ch3\u003eFocus Area\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eTesla's public facing web applications\u003c/li\u003e\n\u003cli\u003eVulnerabilities in other applications owned by Tesla\u003c/li\u003e\n\u003cli\u003eVehicles or product related issues must be submitted by email in order to qualify for a reward, see above for instructions\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eThe following findings are out of scope:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eTesla account MFA issues are out of scope at the present time\u003c/li\u003e\n\u003cli\u003eWAF bypass\u003c/li\u003e\n\u003cli\u003eOpen redirects / Lack of security speedbump when leaving the site\u003c/li\u003e\n\u003cli\u003eInternal IP address disclosure\u003c/li\u003e\n\u003cli\u003eAccessible Non-sensitive files and directories (e.g. README.TXT, CHANGES.TXT, robots.txt, .gitignore, WSDL, pprof, etc.)\u003c/li\u003e\n\u003cli\u003eSocial engineering / phishing attacks\u003c/li\u003e\n\u003cli\u003eSelf XSS\u003c/li\u003e\n\u003cli\u003eText injection\u003c/li\u003e\n\u003cli\u003eEmail spoofing (including SPF, DKIM, DMARC, \u003cem\u003eFrom:\u003c/em\u003e spoofing, and visually similar, and related issues)\u003c/li\u003e\n\u003cli\u003eDescriptive error messages (e.g. stack traces, application or server errors, path disclosure)\u003c/li\u003e\n\u003cli\u003eFingerprinting/banner disclosure on common/public services\u003c/li\u003e\n\u003cli\u003eClickjacking and issues only exploitable through clickjacking\u003c/li\u003e\n\u003cli\u003eCSRF issues that don't impact the  integrity of an account (e.g. log in or out, contact forms and other publicly accessible forms)\u003c/li\u003e\n\u003cli\u003eLack of Secure and HTTPOnly cookie flags (critical systems may still be in scope)\u003c/li\u003e\n\u003cli\u003eLack of rate limiting\u003c/li\u003e\n\u003cli\u003eLogin or Forgot Password page brute force, account lockout not enforced, or insufficient password strength requirements\u003c/li\u003e\n\u003cli\u003eHTTPS mixed content scripts\u003c/li\u003e\n\u003cli\u003eUsername / email enumeration by brute forcing / error messages (e.g. login / signup / forgotten password)\n\n\u003cul\u003e\n\u003cli\u003eExceptional cases may still be in scope (e.g. ability to enumerate email addresses via incrementing a numeric parameter)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eMissing \u003ca href=\"https://owasp.org/www-project-secure-headers/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHTTP security headers\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eTLS/SSL Issues, including BEAST BREACH, insecure renegotiation, bad cipher suite, expired certificates, etc.\u003c/li\u003e\n\u003cli\u003eDenial of Service attacks\u003c/li\u003e\n\u003cli\u003eOut-of-date software\u003c/li\u003e\n\u003cli\u003eUse of a known-vulnerable component (exceptional cases, such as where you are able to provide proof of exploitation, may still be in scope)\u003c/li\u003e\n\u003cli\u003ePhysical attacks against Tesla's Facilities / Property\u003c/li\u003e\n\u003cli\u003eRelay or RollJam attacks pertaining to the keyfob, NFC card, and/or phone-as-key\u003c/li\u003e\n\u003cli\u003eAdversarial modification of the vehicle's environment to confuse Autopilot\n\n\u003cul\u003e\n\u003cli\u003eWe still monitor for and appreciate hearing from researchers on new or novel findings in this area\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":"\u003cp\u003eWe support the open publication of security research. We do ask that you give us a heads-up before any publication so we can do a final sync-up and check.\u003c/p\u003e"},"scope":[{"id":"b5a976b1-b89c-48f6-b47b-67e07e4518d3","name":"Non-vehicle vulnerabilities","targets":[{"id":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2","uri":null,"name":"*.tesla.cn","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f32db9bd-6494-4d01-b743-4b5afc30227f","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"},{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cda9059d-f64e-4d5b-83cf-5d2dc6ecc9f2"}],"recentChangeFlags":null},{"id":"30cc6d53-b3db-4d4f-92be-2b4b8a4e91dd","uri":null,"name":"*.tesla.services","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"33743312-d9fd-4000-9d85-c8f45e40de17","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"30cc6d53-b3db-4d4f-92be-2b4b8a4e91dd"}],"recentChangeFlags":null},{"id":"234594cd-bdfc-4460-808e-d6326c17b048","uri":"https://apps.apple.com/us/app/tesla/id582007913","name":"Official Tesla iOS apps","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1d55c2a7-52d5-40d0-9789-7c6804c9a5be","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"234594cd-bdfc-4460-808e-d6326c17b048"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"234594cd-bdfc-4460-808e-d6326c17b048"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"234594cd-bdfc-4460-808e-d6326c17b048"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"234594cd-bdfc-4460-808e-d6326c17b048"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"234594cd-bdfc-4460-808e-d6326c17b048"}],"recentChangeFlags":null},{"id":"741c0980-07b7-47f4-84cd-0dee37dbe78d","uri":null,"name":"*.tesla.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"15a2932b-50ac-4690-b846-51e811103b14","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"741c0980-07b7-47f4-84cd-0dee37dbe78d"},{"id":"3a3487a7-9abf-45f0-8057-51dabed20371","name":"Drupal","targetId":"741c0980-07b7-47f4-84cd-0dee37dbe78d"},{"id":"4077ab03-37ce-4c7d-8634-ea59ba5ef456","name":"Varnish","targetId":"741c0980-07b7-47f4-84cd-0dee37dbe78d"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"741c0980-07b7-47f4-84cd-0dee37dbe78d"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"741c0980-07b7-47f4-84cd-0dee37dbe78d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"741c0980-07b7-47f4-84cd-0dee37dbe78d"}],"recentChangeFlags":null},{"id":"cecf0ea8-979d-4e13-99f9-01aac3d66d42","uri":null,"name":"*.teslamotors.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5d0474ab-95bf-4b3d-bc68-89f9836e884c","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cecf0ea8-979d-4e13-99f9-01aac3d66d42"}],"recentChangeFlags":null},{"id":"fb4b8fd9-a41a-4160-90bf-f710539a0aea","uri":null,"name":"Any host verified to be owned by Tesla Motors Inc. (domains/IP space/etc.)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9fe60875-69db-4cc8-869e-48b02de7ca80","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fb4b8fd9-a41a-4160-90bf-f710539a0aea"}],"recentChangeFlags":null},{"id":"cee420c9-aca7-4a6d-b8a1-73fea44baccc","uri":"","name":"*.solarcity.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7e5a5bc3-48c7-4af6-8c11-e6406d1f608e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cee420c9-aca7-4a6d-b8a1-73fea44baccc"}],"recentChangeFlags":null},{"id":"43ea949f-11b1-4145-934a-f2beca0490c7","uri":null,"name":"*.teslainsuranceservices.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b7415694-7a26-453d-b3e8-6158d9d35710","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"43ea949f-11b1-4145-934a-f2beca0490c7"}],"recentChangeFlags":null},{"id":"8ad4cf8e-e01c-4c0d-9b27-de8b7d88c37e","uri":"https://play.google.com/store/apps/details?id=com.teslamotors.tesla\u0026hl=en_US\u0026gl=US","name":"Official Tesla Android apps","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d4b6fe9c-03c2-4819-9482-a6f0ef2531de","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"8ad4cf8e-e01c-4c0d-9b27-de8b7d88c37e"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"8ad4cf8e-e01c-4c0d-9b27-de8b7d88c37e"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"8ad4cf8e-e01c-4c0d-9b27-de8b7d88c37e"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"8ad4cf8e-e01c-4c0d-9b27-de8b7d88c37e"}],"recentChangeFlags":null},{"id":"85d9a51f-8ca1-470c-b769-eae99a88bc30","uri":"","name":"Tesla Energy hardware you own","category":"hardware","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9e517f12-7969-41b0-841d-cc00b42528d7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"736c2fc4-a8f9-47ee-917a-f9a2d004a568","p1MaxCents":1000000,"p1MinCents":300000,"p2MaxCents":400000,"p2MinCents":50000,"p3MaxCents":70000,"p3MinCents":20000,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":3000,"max":10000},"2":{"min":500,"max":4000},"3":{"min":200,"max":700},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"f859c60a-1556-44f2-826b-dd83dd5fdf71","name":"Vehicle Targets","targets":[{"id":"d626edc2-5a07-41e6-8bd6-c900b05000d5","uri":null,"name":"Tesla vehicle hardware that you own","category":"hardware","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"46dd4e6f-992f-4130-8591-86a8123a0406","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee6e7cc3-455d-4d97-b43e-5b8de420d096","name":"Hardware Testing","targetId":"d626edc2-5a07-41e6-8bd6-c900b05000d5"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"2014126f-7953-4a82-a129-d66201a0da2a","p1MaxCents":10000000,"p1MinCents":5000000,"p2MaxCents":5000000,"p2MinCents":2000000,"p3MaxCents":2000000,"p3MinCents":1000000,"p4MaxCents":1000000,"p4MinCents":50000,"p5MaxCents":50000,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch1\u003ePayout Guidelines\u003c/h1\u003e\n\n\u003cp\u003eThe following section shows the range of payouts along with specific examples of impact. Within a category, the amount will depend on factors such as how much owner interaction is required, the capabilities of a compromised process (in the case of code execution), and the quality of the report.\u003c/p\u003e\n\n\u003cp\u003eThe below examples are not meant to be an exhaustive list of all valid findings within the program, but are meant to provide some clearer high-level guidelines and inspiration to researchers.  If you have a security issue to report to us that does not fall into the below categories, please do not hesitate to reach out to us with your findings.  We will continue to update the table with relevant categories and their associated payouts.\u003c/p\u003e\n\n\u003cp\u003eIf a vulnerability falls into multiple categories, the highest severity applies.\u003c/p\u003e\n\n\u003ch2\u003eCritical ($50,000 - $100,000)\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eRemote zero-click to unconfined root on infotainment\u003c/li\u003e\n\u003cli\u003eAny remote code execution on a CAN-connected ECU, e.g. Autopilot, VCSEC, Gateway\u003c/li\u003e\n\u003cli\u003eInfotainment pivot to CAN-connected ECU, e.g. Autopilot, VCSEC, Gateway\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eHigh ($20,000 - $50,000)\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eRemote one-click to unconfined root on infotainment\u003c/li\u003e\n\u003cli\u003eUnconfined root persistence on infotainment or Autopilot\u003c/li\u003e\n\u003cli\u003eRemote zero-click on lower-privileged peripherals (WiFi/BT firmware, baseband)\u003c/li\u003e\n\u003cli\u003eLocal privilege escalation from unprivileged process\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eModerate ($10,000 - $20,000)\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eUnprivileged remote code execution on infotainment\u003c/li\u003e\n\u003cli\u003eUnconfined root on infotainment or Autopilot via ethernet\u003c/li\u003e\n\u003cli\u003eUnconfined root on infotainment or Autopilot via USB\u003c/li\u003e\n\u003cli\u003eZero-click radio module remote code execution\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eLow ($500 - $10,000)\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eUnprivileged persistence on infotainment or Autopilot\u003c/li\u003e\n\u003cli\u003eLocal drive authentication bypass\u003c/li\u003e\n\u003cli\u003ePIN-to-Drive bypass\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch4\u003eWe do not award bounties for:\u003c/h4\u003e\n\n\u003cul\u003e\n\u003cli\u003eRelay attacks\u003c/li\u003e\n\u003cli\u003eHardware-based glitching and side-channel attacks\u003c/li\u003e\n\u003cli\u003eConfusing Autopilot by modifying the environment, such as adding lines to the road (CWE-XKCD-1958 attacks)\u003c/li\u003e\n\u003cli\u003eTesla-specific known issues (e.g., publicly reported or previously reported by another researcher)\u003c/li\u003e\n\u003cli\u003eChromium and/or Webkit bugs, unless chained with a full sandbox escape\u003c/li\u003e\n\u003cli\u003ePersistence and/or secure boot bypasses on Tegra-based infotainment systems\u003c/li\u003e\n\u003cli\u003eAttacks that require physical access on Tegra-based infotainment systems\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003ePayout Factors\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eIf a vulnerability affects multiple systems, e.g. shared code, bounty will be determined by the highest single amount with a bonus determined at Tesla\u0026#39;s discretion\u003c/li\u003e\n\u003cli\u003eThe bounty amount may be reduced if the attack is unreliable, relies on unusual conditions being met, etc.\u003c/li\u003e\n\u003cli\u003eA working proof-of-concept will help ensure you receive the maximum applicable payout for your report\u003c/li\u003e\n\u003cli\u003eInternal duplicates that are not yet fixed will still be rewarded at a reduced amount\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting Tegra-based infotainment systems are rewarded at Tesla\u0026#39;s discretion, along with a reduced payout\u003c/li\u003e\n\u003cli\u003eSuperchargers and related infrastructure are out of scope\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eWe may at our discretion award payouts for CVEs in third-party code that affect us, provided it\u0026#39;s an unknown risk and the report demonstrates impact.\u003c/p\u003e\n\n\u003ch1\u003eRoot access program\u003c/h1\u003e\n\n\u003cp\u003eTo promote further security research, Tesla offers security researchers the opportunity to retain root access on their infotainment system even after their reported vulnerability has been patched.  In order to qualify, a researcher must send in a valid report describing a novel way to gain root access on a Tesla infotainment system.  Upon confirmation, Tesla will instruct the researcher on how to use their existing root access to enable the researcher SSH feature, along with an SSH certificate for the researcher\u0026#39;s public key (tailored to their specific hardware ID).  The certificate restricts SSH access to the local diagnostic ethernet link. Tesla may renew the certificate as long as the researcher continues reporting vulnerabilities.\u003c/p\u003e","rewardRangeData":{"1":{"min":50000,"max":100000},"2":{"min":20000,"max":50000},"3":{"min":10000,"max":20000},"4":{"min":500,"max":10000},"5":{"min":0,"max":500}},"recentChangeFlags":null},{"id":"98e995f1-cc82-4706-b13c-3166feeedf6b","name":"OUT OF SCOPE","targets":[{"id":"d353c035-8851-480e-b25c-940cb95a8731","uri":null,"name":"employeefeedback.tesla.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8c137fb5-0fbf-4566-a8c3-72623905d11b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d353c035-8851-480e-b25c-940cb95a8731"}],"recentChangeFlags":null},{"id":"ce339ccb-82dd-44f3-8845-a9eb938cffe9","uri":null,"name":"energysupport.tesla.com (you can report vulnerabilities to bugbounty.zoho.com)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c9f04710-74ed-4ed0-bff5-a8ed0fe42272","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ce339ccb-82dd-44f3-8845-a9eb938cffe9"}],"recentChangeFlags":null},{"id":"849baf29-3524-451f-9b1f-9c8abf6ce432","uri":"https://engage.tesla.com/","name":"engage.tesla.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1d6dba7b-d1c7-4b03-8d52-b3d3aacc1610","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"849baf29-3524-451f-9b1f-9c8abf6ce432"}],"recentChangeFlags":null},{"id":"9bef7a8a-bd0a-47a9-95f0-031fdc08077c","uri":"","name":"*.engage.tesla.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0987361b-c42b-42e9-866a-d67a9c2e3db6","sortOrder":3},"sortOrder":3,"tags":null,"recentChangeFlags":null},{"id":"5e571bf3-f1b1-4689-82e9-60f12790674d","uri":null,"name":"feedback.tesla.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"21628414-ce84-4432-8234-a94956ed8d51","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5e571bf3-f1b1-4689-82e9-60f12790674d"}],"recentChangeFlags":null},{"id":"d2543765-9619-46c2-96f7-11904c7c9463","uri":null,"name":"feedback.teslamotors.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c357ae6a-809e-483f-b963-9410a09485c4","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d2543765-9619-46c2-96f7-11904c7c9463"}],"recentChangeFlags":null},{"id":"4d44d625-f6ca-4ede-8f7d-592c4a52bcc4","uri":null,"name":"ir.tesla.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"03493c11-6bf7-47da-b7af-15a67a361e34","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4d44d625-f6ca-4ede-8f7d-592c4a52bcc4"}],"recentChangeFlags":null},{"id":"04872d4e-5a34-4aec-83db-6b628b3501a3","uri":null,"name":"ir.teslamotors.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b50957b6-15c8-4909-be84-40dfb6fd873c","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"04872d4e-5a34-4aec-83db-6b628b3501a3"}],"recentChangeFlags":null},{"id":"91b6dc86-62e3-4021-8fbc-b4d11bd5e9e2","uri":null,"name":"mkto.teslamotors.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fc857e9d-a01a-4531-852a-099cd155a271","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"91b6dc86-62e3-4021-8fbc-b4d11bd5e9e2"}],"recentChangeFlags":null},{"id":"bc5f1df1-ff70-4392-8c31-b1b005c20eab","uri":null,"name":"shop.eu.teslamotors.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bde3317d-87e9-4741-ab2a-1b5abec0b3df","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bc5f1df1-ff70-4392-8c31-b1b005c20eab"}],"recentChangeFlags":null},{"id":"8661621b-76c9-483d-a424-8c953f5102da","uri":"","name":"service.tesla.com/docs/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3f4f7eea-d141-49ae-81da-b218e87efb4f","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8661621b-76c9-483d-a424-8c953f5102da"}],"recentChangeFlags":null},{"id":"7199d20d-9a6f-40f3-8c10-4d47fa5fb394","uri":"","name":"service.tesla.cn/docs/*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"67149886-b048-4379-b361-68502797d856","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7199d20d-9a6f-40f3-8c10-4d47fa5fb394"}],"recentChangeFlags":null},{"id":"66c3e302-b7d1-41ad-9c28-6969f2f671d2","uri":null,"name":"Any domains from acquisitions, such as maxwell.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c2233d66-da44-4b21-a895-252363ebe836","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"66c3e302-b7d1-41ad-9c28-6969f2f671d2"}],"recentChangeFlags":null},{"id":"eb154d63-afcf-411f-8f24-a16fb34b6cce","uri":null,"name":"Any other third-party websites hosted by non-Tesla entities","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f3cb9fcc-e559-4fc6-b2d7-b1f7067817b4","sortOrder":13},"sortOrder":13,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"eb154d63-afcf-411f-8f24-a16fb34b6cce"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"fb3f327b-e94b-479e-b9ca-c5978bc08587","code":"tesla","state":"in_progress","endsAt":null,"bountyId":"df8e7899-f54a-46f4-aad2-85675570fadf","startsAt":"2015-08-04T15:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Automotive","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/b265/6d1f/a8ad595f/5a63bf599bb4db813eb159c6a32723dc_Tesla_T-Logo_Red-leeeeet.png","logoBackgroundColor":"#191919","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2015-08-04T15:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/tesla","changelogs":"/engagements/tesla/changelog","submissions":null,"announcements":"/engagements/tesla/announcements","hallOfFame":"/engagements/tesla/hall_of_fames","crowdstream":"/engagements/tesla/crowdstream"},"announcementsCount":2,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/tesla/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=tesla\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/tesla/engagement_subscribers","engagementChangelogsUrl":"/engagements/tesla/changelog","publishedAt":"2025-10-30T20:56:26.010Z","engagementChangelogUrl":"/engagements/tesla/changelog/fd49b343-a058-4718-9b7b-dbb3199dc555","createUserFeedbacksUrl":"/engagements/tesla/feedbacks","engagementCrowdstreamUrl":"/engagements/tesla/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}