Bounty Payouts Double in Two Years
GitHub’s Security Bug Bounty Program has now paid out more than $2 million in total rewards to researchers, crossing that threshold just two years after hitting the $1 million mark in 2019. In the past year alone, the company paid over $800,000 in bounties across its programs. Since 2016, payouts through HackerOne have reached $2,355,773, spread across 235 vulnerabilities from submissions made between February 2021 and February 2022.
Those numbers reflect a period of growth and operational change. GitHub stood up a dedicated internal bug bounty team last year, placing it within the Product Security Engineering organization, and the move has paid off in engagement as well as payouts. Contributors to the program grew 21% year over year, and first-time reports increased 18%. The program received 1,363 submissions across public and private scopes, with January 2022 setting a monthly record of 149 submissions.
Response Times and Researcher Rewards
GitHub has also improved its responsiveness to researchers. Average first response time now stands at 12 hours, down an hour from 2020. The program’s largest single bounty ever was awarded in November 2021: $50,000 for one vulnerability report.
Rewards aren’t just going to the researchers themselves. GitHub matched more than $64,000 in bounty donations from researchers, bringing total charitable contributions to $128,234 through the program’s donation matching initiative.
A Path Traversal Find in GHES
One of the most notable submissions of 2021 concerned a path traversal vulnerability in GitHub Enterprise Server (GHES), reported July 2, 2021. The flaw sat in the process for building GitHub Pages sites. GitHub Pages let users customize their sites through a range of configuration options, but those user-controlled settings were not sufficiently restricted. An attacker with permission to create and build a GitHub Pages site on the GHES instance could exploit the weakness to read files on the server.
The issue was fixed in GHES 3.1.8, 3.0.16, and 2.22.22, and affected all prior versions. It received CVE-2021-22867, but a finding of a bypass in the original fix led to a second identifier, CVE-2021-22868, being issued. The bypass used a different payload to achieve the same kind of path traversal.
Researcher yvvdwf reported the initial vulnerability and helped test the fix. That variant analysis uncovered the bypass in GitHub’s own remediation work, prompting a bonus for the original report and a separate bounty for the additional finding.
Program Scope and Future Plans
The bounty scope continues to expand as GitHub brings new products and services under the program’s umbrella. npm was added to scope this year after an initial private bounty effort. That private phase produced three critical vulnerability reports, and GitHub plans to keep using targeted private bounties as part of its broader security strategy.
Beyond monetary payouts, GitHub is exploring non-monetary rewards for reports that do not qualify for a bounty. The goal is to recognize researchers based on what drives them, whether that is financial compensation or public recognition for their work.
GitHub also announced it will host its first live hacking event with HackerOne in June 2022. Attendance will be limited, and the event is designed to support both in-person and remote participation. Interested researchers can find information about invitations to this and future live events on HackerOne’s live hacking events page.
Looking ahead to the program’s ninth year, GitHub plans further work on response times and community engagement, with continued review of rewards to keep them competitive. The program remains open to researchers at all levels, with full details on scope, rules, and payouts available on the bounty program website.
