Computer security specialists discovered 213 vulnerabilities in the national instant messenger Max as part of the program, said Alexey Batiuk, technical director of Positive Technologies.
“Practice has shown that this method is very effective, because white hat hackers and cyber researchers are interested in searching for vulnerabilities and getting paid for it,” Batiuk said at the Svyaz-2026 international exhibition (quoted by Kommersant).
As part of the Bug Bounty, we have been searching for vulnerabilities in Messenger since July 1, 2025. Meanwhile, on Max’s page on the Standoff365 Bug Bounty platform I mentionedThat as of April 10, 288 reports of vulnerability had been accepted, and the total amount of payments was close to 22 million rubles.
As one white hat hacker familiar with Max’s vulnerability research told Kommersant, they often find vulnerabilities that allow unauthorized access to someone else’s data or actions by replacing the object identifier (for example, a message, chat, or user ID).
The Max press service stated that all data of users of the messaging program is reliably protected. “Bug Bounty is a global standard and a sign of mature security: independent ‘white hat hackers’, for a fee, help find and quickly fix vulnerabilities before attackers exploit them,” messenger representatives said.
Are you reading us from outside Russia? Help Meduza help your loved ones in Russia! 1) Send them a pdf file With instructions about VPN and other useful information. 2) He buys Books and merchandise in Our Store and sign up for regular donations to Medusa. Your support = “Medusa” is always at hand. We will somehow deal with the obstacles.
Russian authorities are actively promoting the Max messenger, which VK launched in March 2025. Against this background, Roskomnadzor is blocking other popular instant messengers – Telegram and WhatsApp.
Max has been repeatedly criticized due to the fact that the messenger can spy on the user, as well as for security problems.