Microsoft ties bug bounty rewards to Complete versus Not Complete reports
Original title: Microsoft Introduces New Bug Bounty Rules That Could Affect Security Researchers’ Rewards
Reports filed on or after October 20, 2026, at 8 AM Pacific need a PoC and exploitability details to count as Complete.
The Microsoft Security Response Center replaced multiple report-quality levels with two assessments, Complete and Not Complete, for bug bounty submissions on or after October 20, 2026. Completeness is judged from the initial submission and is separate from severity, program scope, and payment eligibility. Complete reports may receive higher rewards. AI vulnerability reports must still follow Microsoft's published AI reporting guidelines.
- Earlier submissions still follow the previous quality requirements.
- A Complete report needs reproduction steps, a minimal proof of concept, and the vulnerability type.
- Researchers should name the environment, versions, root cause, and attacker prerequisites.
- Evidence can include crash dumps, packet captures, Process Monitor logs, or video demos.
- Vendors
- Microsoft
- Organizations
- Microsoft Security Response Center
From the original article
2 min read at gbhackers.com
Microsoft has introduced new rules for assessing reports in its bug bounty programs, tying submission completeness more directly to potential rewards. Announced by the Microsoft Security Response Center (MSRC) on October 20, 2026, these changes replace the previous multiple report quality levels with two assessments: “Complete” and “Not Complete.” This updated approach establishes clearer expectations […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.