GitHub’s bounty program passes $1M in payouts

GitHub’s Security Bug Bounty program recently crossed a significant threshold: total payouts of $1,000,000 since the program moved to HackerOne in 2016. More than half of that total — roughly $590,000 — was paid out in the last year alone. The program also saw a 40 percent increase in submissions over the same period, while maintaining an average first-response time of 17 hours.

Here’s a look at what drove those numbers, the vulnerabilities that stood out, and where the program is heading in 2020.

2019 highlights

Two critical findings

Among the year’s most notable submissions were two high-impact bugs that illustrate the value of external researchers. One, reported by @not-an-aardvark, was an OAuth flow bypass that could be triggered without any user interaction. The root cause: GitHub’s OAuth authorization controller accepted HEAD requests in addition to POST requests, and CSRF validation is skipped for HEAD requests since they are not typically state-changing. A malicious site could exploit this to authorize an OAuth application automatically.

GitHub shipped a fix within three hours of receiving the report, confirmed via logging that the vulnerability wasn’t exploited in the wild, and backported patches to all supported versions of GitHub Enterprise Server. The researcher received a $25,000 bounty.

The second finding, reported by @ajxchapman, was a remote code execution vulnerability in GitHub.com’s Mercurial import feature. The import logic failed to sanitize branch names, allowing a crafted branch name to execute commands on GitHub’s servers. The feature’s existing sandboxing on dedicated, isolated servers limited the blast radius. The root cause turned out to be an outdated dependency: the bug had already been fixed upstream, but GitHub hadn’t updated to the patched version. The fix was applied to GitHub.com and backported to GitHub Enterprise Server, and logs confirmed no in-the-wild exploitation.

Scope expansions

Several new products and features were added to the bounty program’s scope in 2019:

  • Pull reminders — the acquired Pull Panda functionality, integrated into GitHub’s core app and existing Slack integration.
  • Automated security updates (formerly Dependabot) — automatically opens pull requests to update dependencies when a security fix is available.
  • GitHub for mobile — GitHub’s first iOS/Android app, bringing new API and application security considerations.
  • GitHub Actions — a major new attack surface, allowing users to run code directly on GitHub.com.
  • Semmle’s LGTM tool — enables users to scan code for potential security issues on every pull request.

Bounty-eligible findings in these expanded areas totaled over $20,000 in payouts.

Live hacking and private programs

At the H1-702 live hacking event in Las Vegas in August 2019, GitHub paid out over $155,000 in a single night, half of which went to high- or critical-severity issues. The event included bonuses for best proof of concept, longest exploit chain, and RCE findings, plus a CTF with flags hidden in a Maintainer Security Advisory and GitHub Package Registry.

GitHub also ran invite-only private bounty programs to preview features before public release. These programs paid out just over $37,000 in 2019, with many findings fixed before features reached a broad user base. Targets included the second iteration of GitHub Actions CI/CD, the Dependabot integration, and the pull reminders feature with its Slack connectivity.

2020 initiatives

Security Lab bounty program

GitHub launched a separate bounty program under its Security Lab to improve security across open source software. Rather than exploiting a specific vulnerability, researchers are rewarded for writing CodeQL queries that detect entire classes of vulnerabilities, which others can then run against their own projects. This approach is designed to fix vulnerabilities at scale.

The program has so far received 20 submissions, awarded almost $21,000, and directly contributed to hundreds of vulnerability fixes across the open source ecosystem.

CVEs for Enterprise Server findings

Beginning in 2020, GitHub is assigning CVEs to bounty submissions that affect GitHub Enterprise Server. This provides clearer communication to customers about the state of the software and gives researchers additional recognition for their findings.