GitHub Paid $4,000,000 In Rewards For Bug Bounty Program

GitHub, the world’s leading software development platform, is celebrating a milestone: the 10th anniversary of its Security Bug Bounty program.

Over the past decade, the program has not only enhanced the security of GitHub’s services but also rewarded security researchers with a staggering $4 million in total payouts.

A Decade of Milestones

Launched in 2014, the GitHub Security Bug Bounty program was designed to engage with security researchers to identify and report vulnerabilities through a responsible disclosure process.

The program’s primary goal has always been to improve the security of GitHub’s services while recognizing the efforts of researchers with monetary rewards.

2014: The program began focusing on a subset of GitHub’s products and services.
GitHub emphasized the importance of user trust and the need for additional eyes to track down elusive vulnerabilities.
2016: After two years of using a homegrown email-based system, GitHub transitioned to HackerOne, a leading bug bounty platform, to streamline the process.
2017: GitHub boosted payouts and participated in the Hack the World event, offering double reputation points on HackerOne for bugs found on GitHub.
2018: The introduction of the Legal Safe Harbor policy provided better protection for researchers, removing potential legal barriers and encouraging more participation.

Free Webinar on API vulnerability scanning for OWASP API Top 10 vulnerabilities -> Book Your Spot.

2019: The program saw a 40% increase in submissions and expanded its scope to include more products, such as GitHub Actions and GitHub Mobile.
2020: GitHub’s program was ranked in HackerOne’s top ten bounty programs based on cumulative bounties awarded, time to bounty, and the number of resolved vulnerability reports.
2021: GitHub matched over $64,000 in donations from researchers, supporting charities such as Cancer Research UK and the Greater Pittsburgh Community Food Bank.
2022: The launch of the GitHub Bug Bounty swag store allowed researchers to earn merchandise like T-shirts, water bottles, and monetary rewards.
2023: GitHub paid out its highest single reward to date, $75,000, and surpassed $4 million in total rewards.

The 2023 Year in Review

In 2023, GitHub focused on increasing transparency, growing its public and private programs, and expanding its community presence.

Increasing Transparency:

GitHub worked on understanding common feedback themes and implemented changes to ensure clear and detailed responses to researchers.

Introducing limited disclosure of reports on HackerOne was a significant step towards transparency.

Growing Programs:

GitHub ran several private bounty engagements with its VIP program members, known as Hacktocats.

These engagements included testing new features like PATs v2 via GraphQL and GitHub Copilot Chat.

The public program also saw steady growth, with new products and features regularly added to the scope.

Highest Award Value

Total Paid per year

Community Presence:

GitHub’s bounty team attended conferences across the United States, Canada, and Argentina, presenting on relevant topics and hosting meetups.

Notable presentations included “Life of a Bug” at Bsides SF and “Building a Great Bounty Program” at DEFCON.

GitHub also partnered with Capital One and HackerOne to create Glass Firewall, a conference aimed at increasing the representation of women in security.

As GitHub celebrates this milestone, the company remains committed to improving the security of its services and supporting the research community.

With plans to further enhance transparency, grow its programs, and expand community engagement, GitHub’s Bug Bounty program is poised for continued success in future years.

GitHub’s dedication to security and collaborative approach with the research community has set a high standard in the industry.

As the program enters its second decade, the future looks promising for both GitHub and the global community of security researchers.

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Dhivya

Divya is a Senior Journalist at Cyber Security news covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.