GitHub sets up bug bounty program
Posted on 31 January 2014.
GitHub is the latest service to announce that they have started a security bug bounty program.

"The idea is simple: hackers and security researchers find and report vulnerabilities through our responsible disclosure process. Then, to recognize the significant effort that these researchers often put forth when hunting down bugs, we reward them with some cold hard cash," they stated in a blog post on Thursday.

Rewards will range from $100 up to $5000, and the actual amounts are to be decided by the team on a case to case basis, and by taking in consideration a number of factors.

"For example, if you find a reflected XSS that is only possible in Opera, and Opera is <2% of our traffic, then the severity and reward will be lower. But a persistent XSS that works in Chrome, at >60% of our traffic, will earn a much larger reward," they explained.

Initially, bug bounties will be limited to vulnerabilities discovered in GitHub's main website (Github.com), the GitHub API, and GitHub Gist, a service for sharing snippets of code or other text content.

The team says that they will respond as quickly as possible to submissions, and keep the submitter updated as they work on a bug fix. "We will not take legal action against you if you play by the rules," they made sure to add.









Spotlight

Lessons learned developing Lynis, an open source security auditing tool

Posted on 15 October 2014.  |  Lynis unearths vulnerabilities, configuration errors, and provides tips for system hardening. It is written in shell script, installation is not required and can be performed with a privileged or non-privileged account.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 17th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //