Rewards Program

Scope of the Program

• Our Rewards Program scope includes:
  • Hardware / Software vulnerabilities on Samsung Smart TV, Audio and Displays:
    • Models from years 2022 to 2026.
  • Vulnerabilities on Samsung Smart TV, Audio and Displays software:
    • Samsung Smart TV, Audio and Displays apps released by Samsung Electronics Co., Ltd..
    • Vulnerabilities on Samsung Smart TV, Audio and Displays web infrastructures that directly support the operation of Samsung Smart TV, Audio and Displays.
  • Note: we do not publish the list of web infrastructures that directly support the operation of Samsung Smart TV, Audio and Displays.

• We will not reward:
  • Non-security related bugs.
  • Vulnerabilities on any system / device / app / website not mentioned above.
  • Vulnerabilities on websites providing commercial, informational or support related contents (even if related to Smart TV, Audio and Displays).
  • Vulnerabilities that have little or no impact (e.g. XSS that cannot lead to any exploit on a minor website).
  • Security bugs in third-party applications.
  • Security bugs in third-party websites integrated with Samsung.
  • Bugs that are already reported by other participant, or aware by internal reviews.
  • Theoretical vulnerabilities without proof of concept.
  • Denial-of-Service (DoS) attack on website.
  • Bugs affecting only oneself.
  • Clickjacking (Only clickjacking for logged in or authenticated sessions is allowed).

Code of Conduct

• Ethical Testing
  
  Your activities during vulnerability research should not threaten or impact the business, services or users of Samsung and our partners.
  By impact we mean affecting confidentiality, integrity or availability of devices, infrastructure and services.
  Please refrain from:
  • Accessing 3rd party accounts or data (please use test accounts).
  • Attempting denial of service attacks.
  • Using Spam, Phishing or other social engineering techniques.
• More generally, please do not attempt any unethical or illegal activity during testing.
  We will not pursue legal action against security researchers who conduct testing in an ethical manner as specified above.

Eligibility Criteria

• A Working Proof-of-Concept (PoC) Is Required
  • Every submission must include a working Proof-of-Concept (PoC) that demonstrates a concrete security impact.
  • Reports based only on static code review, without a working PoC, will be determined as Not Eligible.
  • A report that only demonstrates a crash is not eligible for a reward and may be forwarded to the development team for a stability review. However, if the report provides verifiable evidence that the crash leads to a practical security impact — such as control of the program counter or execution flow, controlled memory corruption, a denial of service that qualifies under the Severity Classification, or another clearly demonstrated security impact recognized under the program's reward criteria — it will be assessed as eligible.
  • A crash must be reachable in a practical attack path. Crashes produced by artificially bypassing the product's legitimate attack surface — for example, directly loading a native library via dlopen and calling its internal APIs with malformed input, without going through the input validation performed by the calling layers in the actual product — are not considered a valid security impact. Such reports will be determined as Not Eligible unless concrete evidence is provided that the same input can reach the affected code through a legitimate attack path.
  • Severity and reward amounts are determined based on the impact demonstrated by the provided PoC. Claims or assumptions of a higher potential impact – for example, asserting that remote code execution is achievable – are generally not considered valid impact unless supported by a working demonstration.

General Eligibility Requirements for a Reward

• Eligibility Requirements:
  • Issue must not already be known by Samsung (e.g. not already public, not already found by us during a pen test, not already reported by another user...).
  • Issue must have a significant impact.

Required Information

• All reports must include the following items in order to be determined eligible:
  • Version information of the affected product, including the build number
    • Settings > About device > Software information > Build number
    • For web services: Include domain and URL
  • Description of the vulnerability that properly explains the practical security impact
  • Detailed steps to reproduce the report (including video, image, or other means where needed)
  • Working Proof-of-Concept (PoC) that demonstrates a concrete security impact
  • Disclosure plans, if any

Important Requirements

• Static Code Review Only Is Not Acceptable:
  • Reports based solely on static code review without a working PoC demonstrating actual functionality on the product or web service will be considered ineligible.
• Crash-Only Reports Have Limited Eligibility:
  • A report that only demonstrates a crash is not eligible for a reward and may be forwarded to the development team for a stability review. However, if verifiable evidence is provided showing the crash leads to a practical security impact — such as control of the program counter or execution flow, controlled memory corruption, or a denial of service that qualifies under the Severity Classification — the report will be evaluated accordingly.
• Practical Attack Path Requirement:
  • A crash must be reachable through a practical attack path. Crashes that result from artificially bypassing legitimate product attack surfaces are not considered valid security impacts, unless evidence demonstrates the same input can reach the affected code through a legitimate attack path.
• Impact Determination Based on Actual Demonstration:
  • Severity and reward amounts are determined based on the security impact actually demonstrated by the provided PoC. Claims or assumptions of higher potential impact are not considered valid unless supported by a working demonstration.
• Missing Required Information Reduces Reward:
  • If required information is not provided, the base reward will be significantly reduced.

Hall Of Fame

• Participants who contributed in identifying security issues in the above defined scope will be mentioned on our Hall of Fame page.
  • Note: we do not give paper certificates, letters of recommendation, etc.

Monetary Reward

• We will reward qualifying bugs depending on the maximum severity of the vulnerability and the priority of the target impacted.
• We will provide higher reward scores for:
  • Reports on vulnerabilities regarding any Smart TV, Audio and Displays security solution. (e.g remotely compromise verified boot, kernel).
  • Reports on vulnerabilities with detailed and specific information (e.g., proof of concept & source code, test case, patches).

Non-Monetary Rewards

• You hereby acknowledge that the final decision to provide the reward and the amount of the reward is at Samsung’s sole and complete discretion.
  • Note: we do not provide rewards in the form of Samsung devices, swag, goodies, etc.

Payment Account Policy

• Reward payments will be made exclusively to a personal bank account held in the reporter's name.
  • Note: Corporate or organizational bank accounts are not accepted.

• We will make commercially reasonable efforts to meet the following turnaround time :
  • Time to issue an initial response (from date of report submission) - 1 business day
  • Time to issue a triage (from date of report submission) - 10 business days