To make a responsible disclosure, learn more about our Responsible Disclosure Policy. On behalf of Salesforce, our customers, and our users, we would like to thank the following researchers for their contributions.

Extraordinary Security Research Contributions

undefined

Hardest Hitting Bug Bounty Hackers of 2021

Congratulations to our Hardest Hitting Bug Bounty Hackers of 2021 – the Bug Bounty Researchers who contributed the five most critical vulnerabilities of those reported to Salesforce’s Bug Bounty Program in 2021. Salesforce Security Staff voted upon this distinguished award to recognize these researchers for upholding Salesforce’s #1 value, Trust.

spaceraccoon
ngocdh
metnew
afewgoats
none_of_the_above

2022 (through March)

Bug Bounty Researchers


Independent Researchers

2021

Bug Bounty Researchers

0ang3el, 4lemon, afewgoats, ahmedehane, ak1t4, ali, amalyoman, amsda, ankitsingh, ansariosama, arneswinnen, asad0x01, ateek, bitsscrambler, bobrov, bubbounty, cdl, d0xing, d4rkm4tter, debsec, discodamone, diskodingo85, djurado, dkd, dz_samir, egrep, erbbysam, g003e, hazimaslam, honoki, hritiksh, indoappsec, inhibitor181, kaktaktoa, kcho, kirtan_patel, kotko, krevetk0, lucio, m0chan, m1s13ksnk, melar_dev, metnew, michael1026, mikee, nadino, nagli, nanwn, ngocdh, niemand_sec, nnez, node1, none_of_the_above, not_stoppable, p4fg, patrik, pnig0s, preben, proabiral, ramsexy, randomdeduction, ras-it, rhynorater, securitybreaker, sergeym, sheikhimmi, shubs, skavans, sml555, smsecurity, spaceraccoon, stuxnite, svennergr, tbehroz, the_arch_angel, todayisnew, tolo7010, try_to_hack, w--, w2w, wirtha, yaworsk, zonduu

Independent Researchers

2019 -2020

0xd0m7, 0xcaptainfreak, 4bg0p, 0ang3elakhilmm, alexeypetrenko, alfazero, alittleninja, amontes, ankitkrdixit, ankitsingh, annunaki, anonym0us_py, anshuman_bh, apox, appsecure_in, arl_rose, arneswinnen, asad0x01_, ashish_r_padelkar, ateek, bejaminkm, bobrov, brdoors3, bubbounty, bugbasher, bughunterboy, c1231665, cdl, charityhackers, charlieeriksen, chernobyl, cmd-0_0, constructor2019, cr4xerbik4sh, cyb1, d0nut, d3n0, dataalchemist, delisyd, derision, dhakal_ananda, dkd, dvl, dz_samir, edoverflow, eelsivart, egrep, erbbysam, fishofprey, foobar7, frozensolid, goravseth, gujjuboy10x00, hack_all_things, hackdev16, harisec, hazimaslam, hdbreaker, httpsonly, indoappsec, inhibitor181, intidc, isecurity, jackds, jahin0x01, jepatel, jllis, jong_jong, jsadler01, kapytein, kasperkarlsson, kazan71p, kcho, khizer47, kusl, lagertha, lfb, linkks, luied1920, m7mdharoun, mantis, mattaustin, metnew, michael1026, mikee, mlitchfield, moshemiz, mr_r0w07, narenp, neema, ngalog, ngocdh, nih8l, none_of_the_above, nullboy, p4fg, paresh_parmar, pcastagnaro_sfdc, pen3t3r, piyushmalik, pnig0s, poutine_hero, prateek_0490, protector47, psaux, pufo, pxh3, quanyang, r0x33d, ramsexy, randbug101, randomdeduction, randomusername, ras-it, redguard, rijalrojan, ris, rubyroobs, rudnkh, ruvlol, rz01, samux, securitybreaker, securitythinker, sergeym, shahmeer-amir, shailesh4594, shepard, silenthunter, skavans, slechjke, smaury, smiegles, smsecurity, sniper302, sp1d3rs, stok, streaak, strukt, sub_super, suhas_gaikwad, sunil_yedla, sysecure, ta8ahi, tahaismail9, techguynoob, todayisnew, tolo7010, tophersmith116, try_to_hack, trying_to_hack, txt3rob, ubepkr, vinothkumar, vp40, vulnh0lic, wh11tew0lf, whitehatter, wirtha, yashrs, yotamc19899, z0mb13, zapprising, zephrfish, zeroflaw, zigoo0, ziot

2017 -2018

Ervin Weber, Priyanshu Sahay, Elamaran V(BHEL Trichy), TechguySarath, Fredrik Almroth, David Dworken, Karim Valiev, Ankit Mittal, Chris Bland, Ruby Nealon <rubyroobs>, Andrew Leonov, Arne Swinnen, Anand Prakash, Guilherme Cesar Leite, Moataz Jemni, Hussain Adnan Hashim, Peter Yaworski, Ben Buechner, Ian Bouchard, Jubaer Al Nazi, Missoum Said, Yaala Abdellah, Samir Hadji, Evgeniy Yakovchuk, Karl Aparece, Hazim Aslam, Daniel Ballinger, Deepak K, Pier-Luc Maltais, Sergey Bobrov, Deepanker Chawla, Ahsankhan, Mohammed Fayez Ahmed Albanna, Elamaran V, Muhammad Khizer Javed, Iordache Cosmin, Muhammad Hassham Nagori, Gujjuboy10x00(Vishal), Osama Ansari, Prakash Sharma, Marius Horatau, Johnny Nipper, Simon Bräuer, TechguySarath, Tomi Koski, Ashish Padelkar, Stanko, SPQR, Sandeep Singh, Jens Müller, Waleed Ezz Eldin (WIBF), SecuNinja, Darshit Varotaria (Krydence Technologies -Trusted Digital Security Ally), Ankit Mittal

2016

Hadji Samir, Char49, Eusebiu Blindu, Peter Yaworski, Abdul Haq Khokhar, Abdul Rehman, Mustafa "strukt" Hasan, Frans Rosén, Yassine ABOUKIR, Raghav Bisht, Nikhil Kumar Srivastava, Jay Patel, Sagar Shah, Stefano Vettorazzi, David Vieira-Kurz (@secalert), Sasi Levi, Sandeep Singh, Artur Czyż, Ajay chavda, Matvejs Mascenko, Max Prietzel, Nightwatch Cybersecurity, jay k patel, Muhammad Hassaan Khan, Stephen Sclafani, Kacper Kwapisz, Seif Elsallamy, Arie Timmerman, Abhinav Karnawat \/ w4rri0r \/, satish bommisetty, Noriaki Iwasaki, harisec, Max Moroz, Dzmitry Lukyanenka, Deepanker Chawla, Nassim Bouali, Jose Luis Zayas Banderas, Teemu Kääriäinen, Issam Rabhi, Vathsa, Abdullah Hussam, psych0tr1a, PsihoZ26, Mustafa Hasan (strukt), Luciano Corsalini, Fizer Khan, Paulos Yibelo, Avram Marius Gabriel, N B Sri Harsha, Mathias Karlsson, Arsiadi Sriyanto, Cîrjă Florinel-Vasile (Quistertow), Darius Petrescu, Tomasz Bojarski, Pranav Hivarekar, Santiago "Mr Hack" López, Muhammad Asim Shahzad, karthickumar (Ramanathapuram), Yasir Altaf Zargar, Nitin Goplani, Hazim Aslam, Nicolas Grégoire, Jigar Thakkar (Akhani), SPQR, Benjamin Kunz Mejri, Jelmer de Hen, Ahmed Aboul-Ela, Arne Swinnen

Reminders

Please note that this page is updated annually. Starting in 2021, we will solely be recognizing researchers who submit valid reports to Salesforce.

Suspect an issue? Privately share full details of the suspected vulnerability with the Salesforce Security team by emailing security@salesforce.com.

Report a Security Concern

As a leading software-as-a-service and platform-as-a-service provider, Salesforce is committed to setting the standard in safeguarding our environment and customers’ data. Partner with us by reporting any security concerns.

Report a Concern