---
title: Security Research and Reporting Issues
framework: Private Cloud Compute Security Guide
role: article
role_heading: Article
path: private-cloud-compute/reportingissues
---

# Security Research and Reporting Issues

Apple runs a research program on live PCC nodes and accepts security and privacy reports through the Apple Security Research site.

## Private Cloud Compute Research Program

Private Cloud Compute Research Program The Private Cloud Compute Research Program gives researchers access to a live PCC node running in research mode, so that the guarantees described in this guide can be examined on a node as it is actually deployed rather than only in published binaries and tooling. The program covers PCC running on Bare-metal A4 instances. Access is granted for a defined research window that we schedule with you. You connect over SSH using a public key you provide, and you carry out the research plan you described in your application. Valid security or privacy findings that you submit to us from your research are eligible for Apple Security Bounty rewards. Eligibility To be eligible for the program, you must: Have a demonstrated track record of security research relevant to the PCC stack. That includes modern operating systems and platforms, virtualization and hypervisors, confidential computing, GPU and accelerator security, hardware roots of trust, or inferencing technologies. Research experience on non-Apple silicon is directly applicable. Have a Google account, or an account linked to Google to access the Google Cloud nodes. Provide your public SSH key. Be able to describe, at a high level, the research you plan to do. Not be employed by Apple, and not have been employed by Apple within the past 12 months. The program is not available in U.S. embargoed countries or regions, or to parties on the U.S. Treasury Department’s Specially Designated Nationals List, the U.S. Commerce Department’s Denied Persons List or Entity List, or any other restricted party list. How to apply Sign in at security.apple.com with the Apple Account you use for security research. Navigate to your account profile and click the three-dot menu. Select “Applications” then “Private Cloud Compute Research Program Application”. Complete the application. You will be asked for your Google or Google-linked account, a public SSH key, and a high-level description of your research plans or goals. After you apply We review every application and respond to let you know your acceptance status. If your application is accepted, we will follow up with the access information you need and work with you to schedule your research window. Reporting security or privacy issues If you believe you have found a security or privacy vulnerability in Apple software or components of Private Cloud Compute (PCC), please report it only to Apple through the Apple Security Research site. Select “Private Cloud Compute” under “Affected Area” in the report form. We review all eligible research for Apple Security Bounty rewards. Security issues related to Google Cloud should be reported directly to Google. Reporting other issues To report a bug (unrelated to security or privacy), an enhancement, or a problem with our documentation, source publications, or tooling, please use Feedback Assistant. Select “Private Cloud Compute” under “What does the Security issue you are seeing involve?” in the report form.