GitHub sets up bug bounty program
Posted on 31 January 2014.
GitHub is the latest service to announce that they have started a security bug bounty program.

"The idea is simple: hackers and security researchers find and report vulnerabilities through our responsible disclosure process. Then, to recognize the significant effort that these researchers often put forth when hunting down bugs, we reward them with some cold hard cash," they stated in a blog post on Thursday.

Rewards will range from $100 up to $5000, and the actual amounts are to be decided by the team on a case to case basis, and by taking in consideration a number of factors.

"For example, if you find a reflected XSS that is only possible in Opera, and Opera is <2% of our traffic, then the severity and reward will be lower. But a persistent XSS that works in Chrome, at >60% of our traffic, will earn a much larger reward," they explained.

Initially, bug bounties will be limited to vulnerabilities discovered in GitHub's main website (, the GitHub API, and GitHub Gist, a service for sharing snippets of code or other text content.

The team says that they will respond as quickly as possible to submissions, and keep the submitter updated as they work on a bug fix. "We will not take legal action against you if you play by the rules," they made sure to add.


More than a third of employees would sell company data

35 percent of employees would sell information on company patents, financial records and customer credit card details if the price was right. This illustrates the growing importance for organizations to deploy data loss prevention strategies.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Jul 31st