Hi Hackers!

As part of our regular program and prioritisation updates, we are reducing the bug bounty scope of the Mbed TLS project to only include attacks against the TF-PSA-Crypto submodule. This helps ensure that we are targetting the area most important to Arm.

Thanks for all the work you've been doing. We look forward to receiving all your reports!

Arm PSIRT

We love enthusiastic security research, and the community response we’ve had to our Trusted Firmware Bug Bounty Program has been great.
Lately, our triage team has been meeting a few too many AI-generated reports that are very difficult to triage. These reports often rely on flawed assumptions, internal-only functions or a lack of real security impact.
To help us focus on genuine, reproducible findings, all reports must now include an end-to-end proof of concept that:

• runs on a TF supported platform (TF-A, TF-M and OP-TEE only; emulated environments are fine)
• reproduces the issue on a correctly implemented system
• demonstrates a meaningful security impact (not just compliance or potential for hardening)

AI has been a game-changer for vulnerability discovery, but an LLM-generated report isn’t enough on its own. Please ensure you always validate and triage your findings before submitting them, and always check your PoC to make sure our team can follow the same path you did.
Thanks for helping us keep the signal high and the bugs real. Happy hunting!!