GitHub sets up bug bounty program
Posted on 31 January 2014.
GitHub is the latest service to announce that they have started a security bug bounty program.

"The idea is simple: hackers and security researchers find and report vulnerabilities through our responsible disclosure process. Then, to recognize the significant effort that these researchers often put forth when hunting down bugs, we reward them with some cold hard cash," they stated in a blog post on Thursday.

Rewards will range from $100 up to $5000, and the actual amounts are to be decided by the team on a case to case basis, and by taking in consideration a number of factors.

"For example, if you find a reflected XSS that is only possible in Opera, and Opera is <2% of our traffic, then the severity and reward will be lower. But a persistent XSS that works in Chrome, at >60% of our traffic, will earn a much larger reward," they explained.

Initially, bug bounties will be limited to vulnerabilities discovered in GitHub's main website (Github.com), the GitHub API, and GitHub Gist, a service for sharing snippets of code or other text content.

The team says that they will respond as quickly as possible to submissions, and keep the submitter updated as they work on a bug fix. "We will not take legal action against you if you play by the rules," they made sure to add.









Spotlight

Using Hollywood to improve your security program

Posted on 29 July 2014.  |  Tripwire CTO Dwayne Melancon spends a lot of time on airplanes, and ends up watching a lot of movies. Some of his favorite movies are adventures, spy stuff, and cunning heist movies. A lot of these movies provide great lessons that we can apply to information security.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Jul 30th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //