Sony Interactive Entertainment (SIE) runs a public PlayStation security program through HackerOne. It began with a June 24, 2020 announcement inviting security researchers, gamers, and other members of the public to test PlayStation 4 and PlayStation Network security. Sony’s published headline reward is significant but narrowly worded: critical PS4 vulnerabilities have bounties starting at $50,000. That is a starting point, not a guaranteed payment for every critical report, and the current HackerOne policy determines eligibility, duplicates, severity and payout.
What Sony’s PlayStation bug bounty program is
The PlayStation Bug Bounty Program is SIE’s vulnerability-disclosure channel for security issues affecting PlayStation products and related services. Researchers submit reports through HackerOne, where Sony’s security team can triage the finding, request evidence, assess its impact and decide whether it qualifies for recognition or a monetary reward.
As an Amazon Associate I earn from qualifying purchases.
SIE announced the public program on June 24, 2020. In that announcement, Geoff Norton, Senior Director of Software Engineering at SIE, said, “At PlayStation, we are committed to providing gamers all over the world with great experiences.” The announcement specifically invited “the security research community, gamers, and anyone else” to test PlayStation 4 and PlayStation Network security.
This is not a general invitation to attack PlayStation infrastructure. It is a controlled research program governed by a live HackerOne policy. The policy defines what may be tested, which techniques are prohibited, how Sony handles duplicate submissions, and when a report earns a bounty. Read those rules immediately before testing because scope and reward terms can change.
#1 Best Overall
- Model Number CFI-2000
- Includes DualSense Wireless Controller, 1TB SSD, 2 Horizontal Stand Feet, HDMI Cable, AC power cord, USB cable, printed materials, ASTRO’s PLAYROOM (Pre-installed game)
- Vertical Stand sold seperately
How much Sony pays
The clearest official figure is from Sony’s 2020 announcement: critical vulnerabilities for PS4 have bounties starting at $50,000. The phrase “starting at” matters. It establishes a published floor for qualifying critical PS4 findings, not an automatic $50,000 payment for every report that a researcher labels critical.
| Question | What is established | What you must verify in the live policy |
|---|---|---|
| Published critical PS4 amount | Critical PS4 vulnerabilities were announced with bounties starting at $50,000 by SIE in 2020. | The current policy’s exact criteria, maximums, qualifying versions and payment conditions. |
| PS5 payout tiers | No complete, current PS5 reward table is stated in the accessible official material. | Whether a PS5 issue has a separate tier and how severity maps to dollars. |
| PlayStation Network, web and mobile payouts | No complete, current public matrix is established in the available official pages. | Asset-specific rewards, exclusions and any special rules for account or store infrastructure. |
| Non-critical findings | The announcement says rewards vary by issue. | Severity thresholds, minimum impact, exploit requirements and any non-monetary recognition. |
A report can fail to earn a bounty even when it describes a real bug. Common reasons include an out-of-scope asset, a duplicate of an earlier report, insufficient security impact, a known issue, a prohibited testing method or failure to follow the disclosure policy. A technically impressive proof that damages data or service availability can also create safety and policy problems rather than increasing the reward.
What is in scope
The original announcement names PlayStation 4 and PlayStation Network. A secondary policy mirror describing the program additionally lists PlayStation 5 systems, operating systems, accessories and PlayStation Network, along with web, iOS and Android assets. It also describes current released and beta system software as eligible, while noting that earlier versions may be accepted case by case.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Asset or version | Evidence and practical interpretation |
|---|---|
| PlayStation 4 | Explicitly covered by Sony’s 2020 announcement; critical PS4 vulnerabilities are the only area with a publicly stated $50,000 starting figure. |
| PlayStation 5 | Listed in the secondary scope description. Confirm the exact models, services and exclusions on the live HackerOne policy. |
| System software | The secondary description includes currently released and beta software. Older releases may be considered case by case rather than automatically accepted. |
| Accessories | Listed by the secondary description, but each accessory and its connected functionality should be checked against the current policy. |
| PlayStation Network | Explicitly named in the original announcement and the later scope description. Do not assume every connected Sony service is included. |
| Web, iOS and Android assets | Recorded by the secondary description. Verify the exact hostnames, applications and exclusions before sending traffic. |
The distinction between official and secondary evidence is important. Sony’s announcement is primary evidence for PS4 and PlayStation Network. The broader PS5, accessory, operating-system and mobile listings come from a policy mirror, so treat them as a lead to verify rather than as a permanent guarantee of scope. The live HackerOne page is the controlling document for a submission.
What makes a report bounty-eligible
Secure@Sony describes a qualifying vulnerability as an issue that could let a potential attacker compromise the integrity, availability or confidentiality of Sony products, associated services or infrastructure. That definition is broader than a cosmetic defect and narrower than any bug that merely produces an unexpected result.
Security impact
Explain what an attacker can actually gain. Examples of useful impact descriptions include unauthorized access to another user’s data, modification of security-sensitive state, bypass of an authorization boundary, code execution in a protected component or a realistic way to disrupt an important service. A crash with no meaningful security consequence normally needs more evidence than a vulnerability that crosses an account or privilege boundary.
Exploit quality
Show a reliable, minimal-impact path from the starting condition to the security impact. If exploitation requires unusual privileges, a specific firmware build, physical access or a victim interaction, state that limitation. Do not inflate severity by omitting prerequisites.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- CPU: x86-64-AMD Ryzen Zen 8 Cores / 16 Threads at 3.5GHz.GPU: AMD Radeon RDNA 2-based graphics engine.
- 16GB GDDR6/256-bit Memory; 825GB SSD Storage Capacity
- Ethernet (10BASE-T, 100BASE-TX, 1000BASE-T), IEEE 802.11 a/b/g/n/ac/ax, Bluetooth 5.1
- HDR technology, 8K output, 4K TV gaming, Up to 120 fps with 120Hz output, Tempest 3D AudioTech
- What's Included: Sony PlayStation 5 Disc Version; Wireless controller; USB cable, HDMI cable, AC power cord. Nogtox PVT HDMI_cable
Uniqueness and policy compliance
HackerOne generally treats the earliest valid report as the primary submission when several researchers report the same root cause. A report that arrives after an existing submission may be marked duplicate even if its reproduction steps are clearer. Testing must also remain within the program’s safe-harbor and disclosure rules; those terms are defined by the current policy, not by a researcher’s personal interpretation.
How to report a PlayStation vulnerability
- Confirm the target. Identify the exact console model, system-software version, accessory, application, web asset or network service involved. Compare it with the current PlayStation HackerOne scope and exclusions.
- Preserve a safe test environment. Use accounts and devices you control. Keep testing to the minimum traffic and data needed to demonstrate the issue. Do not access, download or alter another person’s information.
- Reproduce the behavior. Repeat the test from a clean state and record the conditions that matter: account role, console configuration, firmware or app version, network position and any required user action.
- Document the impact. Explain the security property affected—confidentiality, integrity or availability—and identify the realistic attacker capability created by the bug.
- Build a minimal proof. Include sanitized logs, screenshots, request and response samples, or a short proof-of-concept that demonstrates the issue without destructive actions. Remove credentials, session tokens, personal data and unnecessary exploit code.
- Submit through HackerOne. Reach the PlayStation program from Sony’s Product Security information or Secure@Sony’s vulnerability-reporting guidance, then use the program’s report form. Select the affected asset and severity according to the available policy fields.
- Answer triage questions. Sony may ask for additional reproduction details, affected versions or a safer demonstration. Reply in the HackerOne report and keep newly discovered evidence in the same report rather than opening duplicates.
- Follow disclosure instructions. Do not publish technical details, proof-of-concept code or affected endpoints unless the program expressly permits disclosure or gives written approval.
What a strong report contains
- A short title naming the vulnerability class and affected PlayStation asset.
- The exact version, build, application or endpoint tested.
- Prerequisites, including account privileges, device access and victim interaction.
- Numbered reproduction steps that another analyst can follow without guessing.
- Expected behavior and actual behavior.
- A clear impact statement tied to confidentiality, integrity or availability.
- Evidence that is complete enough to verify but limited to accounts and data you own.
- Any practical mitigations or conditions that reduce exploitability.
- A disclosure statement confirming that you have not shared sensitive details publicly.
A useful report separates facts from assumptions. For example, say that a request was accepted with a lower-privileged session, then explain why that permits access to a protected function. Do not call an issue a remote-code-execution vulnerability unless you can demonstrate code execution or a well-supported chain that reaches it.
Response times and what they mean
Secure@Sony states: “When you report a vulnerability, you can expect a response within 5 business days and status update within 30 business days.” The first response is an acknowledgement or initial contact, not a promise that the issue has been validated or paid. The 30-business-day status update is likewise a communication expectation, not a guaranteed final resolution date.
Keep your HackerOne notification address current and monitor the report for requests. If a status update does not arrive within the stated window, use the program’s official communication channel and reference the existing report rather than resubmitting the same vulnerability.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common mistakes that reduce the chance of success
Testing outside the listed asset
Researchers sometimes assume that a Sony-owned hostname, a third-party service connected to PlayStation or an unlisted regional endpoint is automatically covered. Scope is asset-specific. If the current policy does not name the target, stop and seek clarification through the program before testing.
Using destructive methods
Denial-of-service traffic, data deletion, account takeover attempts against strangers and broad automated scanning can harm users and violate policy. Demonstrate the smallest safe effect on infrastructure and accounts you control.
Reporting a symptom without security impact
A freeze, error message or unusual response is a starting observation. Explain whether it crosses a privilege boundary, exposes protected data, changes security-sensitive state or creates a realistic service-availability risk. Without that connection, triage may classify it as low impact or informational.
Rank #3
- 🚀 CPU: 3.5GHz, 8-core AMD Zen 2
- 🚀 Storage: Custom 825GB SSD
- 🚀 RAM: 16GB GDDR6
- 🚀 GPU: 10.3 teraflop RDNA 2 GPU
Overstating the reward
The $50,000 figure applies to the announced starting bounty for critical PS4 vulnerabilities. It is not a universal PlayStation price list, a guaranteed amount for PS5, or a promise that every critical label will be accepted. Let Sony’s policy and triage determine the final classification.
Recommended Free Tools
How to check the current rules before testing
- Open Sony’s current Product Security information and follow the PlayStation HackerOne program link.
- Read the live policy’s in-scope assets and exclusions, including regional domains, applications, firmware branches and accessories.
- Check whether the version is released, beta or an older build and note any case-by-case language.
- Review severity definitions, reward tiers, duplicate handling, safe-harbor conditions and disclosure restrictions.
- Save the policy date or revision shown by HackerOne so your report can state which rules you followed.
This check is especially important for PS5, mobile, web and newer network functionality. The accessible official material confirms that Sony continues to list the PlayStation program among its Sony-managed HackerOne programs, but it does not provide a complete current payout matrix. Only the live policy can answer a present-day question about a particular asset or reward tier.
How to evaluate the program against another bounty program
If you are choosing where to spend research time, compare programs on concrete terms rather than headline maximums:
- Which hardware generations, operating systems, accessories and online services are explicitly covered?
- Are current and beta firmware versions eligible, and are older versions accepted?
- What is the critical-severity floor and maximum for each asset class?
- How are duplicates, chained vulnerabilities and partial exploits handled?
- What response and status-update timelines are promised?
- Are mobile applications, account systems, stores and web infrastructure included?
- What testing, automation and public-disclosure restrictions apply?
For PlayStation, the published $50,000 starting figure is specific to critical PS4 vulnerabilities in the 2020 announcement. The broader scope and current reward details require a fresh read of HackerOne’s policy before making a direct comparison.
Bottom line for researchers
Sony’s PlayStation Bug Bounty Program is a legitimate public HackerOne route for reporting security vulnerabilities in PlayStation products and connected services. The strongest established reward fact is that SIE announced critical PS4 bounties starting at $50,000 in 2020. That number is conditional, not guaranteed, and no complete current payout table for PS5, PlayStation Network, web or mobile findings is established in the accessible official material.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsStart with the live scope, test only systems and accounts you are authorized to use, provide a reproducible and low-impact proof, and describe the security consequence precisely. Reports go through HackerOne, with Secure@Sony stating an expected response within five business days and a status update within 30 business days.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
