All critical vulnerabilities in Microsoft, third-party, and open source code are eligible for rewards if they impact Microsoft services.