We ask for all submissions and correspondence to be sent directly to security@telegram.org – Telegram currently does not maintain a presence on third-party bug bounty platforms or services.
Valid reports that result in a change of code or configuration are eligible for bounties, ranging from $100 to $100,000 or more, depending on the severity of the issue. We reserve the right to ultimately determine both the validity and the appropriate compensation for each report at our discretion.