GitHub sets up bug bounty program
Posted on 31 January 2014.
GitHub is the latest service to announce that they have started a security bug bounty program.

"The idea is simple: hackers and security researchers find and report vulnerabilities through our responsible disclosure process. Then, to recognize the significant effort that these researchers often put forth when hunting down bugs, we reward them with some cold hard cash," they stated in a blog post on Thursday.

Rewards will range from $100 up to $5000, and the actual amounts are to be decided by the team on a case to case basis, and by taking in consideration a number of factors.

"For example, if you find a reflected XSS that is only possible in Opera, and Opera is <2% of our traffic, then the severity and reward will be lower. But a persistent XSS that works in Chrome, at >60% of our traffic, will earn a much larger reward," they explained.

Initially, bug bounties will be limited to vulnerabilities discovered in GitHub's main website (, the GitHub API, and GitHub Gist, a service for sharing snippets of code or other text content.

The team says that they will respond as quickly as possible to submissions, and keep the submitter updated as they work on a bug fix. "We will not take legal action against you if you play by the rules," they made sure to add.


eBook: Cybersecurity for Dummies

Posted on 16 December 2014.  |  APTs have changed the world of enterprise security and how networks and organizations are attacked. These threats, and the cybercriminals behind them, are experts at remaining hidden from traditional security while exhibiting an intelligence, resiliency, and patience that has never been seen before.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Dec 17th