GitHub Restructures Its Bug Bounty Program
Introducing a new VIP program and reward structure for security researchers.
1GitHub's Bug Bounty Program
GitHub offers a bug bounty program that encourages security researchers to find vulnerabilities on its platform. This program, supported by researchers worldwide for over a decade, has made GitHub more secure. Recently, significant changes have been made to how the program operates.
2VIP Program Introduced
GitHub has launched a permanent VIP program for researchers who consistently deliver high-quality and impactful work. Participants in this program receive higher payouts, faster response times, and closer collaboration with the security engineering team. The goal is to create a dedicated space for researchers who deeply understand GitHub.
3Changes to the Reward Structure
The bug bounty program has shifted to static payouts. Fixed amounts have been set for low, medium, high, and critical severity levels. This change aims to create clear expectations for researchers and improve the program's manageability.
4Focus on Quality
GitHub has introduced new criteria to enhance the quality of its bug bounty program. Researchers must submit a certain number of critical or high-severity findings to qualify for the VIP program. This incentivizes better reports rather than more reports.
5Opportunities for New Researchers
GitHub is not blocking new researchers from joining the program but instead offers them a limited number of initial submissions. This provides newcomers with genuine findings an opportunity to showcase their skills.
6Future Steps
GitHub is investing in faster response times, clarity, and community engagement to further improve its bug bounty program. The company plans to interact directly with researchers at conferences like DEFCON. These steps aim to make GitHub a more attractive platform for security researchers.
Original article: The GitHub Blog — GitHub Hata Ödülü Programını Yeniden Yapılandırıyor