Microsoft Bug Bounty Program Expanded to Third-Party Code

Microsoft has expanded its bug bounty programme to cover third‑party and open source code, with rewards available for any critical vulnerability that impacts Microsoft services. All critical vulnerabilities in Microsoft, third‑party, and open source code are now eligible if they have a direct and demonstrable impact on online services, according to Microsoft VP Tom Gallagher.

The update adopts an In Scope by Default approach, signalling that researchers can submit findings from code regardless of ownership, with remediation pursued by Microsoft. Gallagher said the new rules align with threat actors’ broad attack surface and that security defects across the ecosystem matter. The change is effective immediately, and all online services are included by default, with new services becoming in scope as they launch. SecurityWeek notes this is part of Microsoft’s Secure Future Initiative, announced in 2023, and follows recent executive moves within the company.