PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

10 Years of the GitHub Security Bug Bounty Program

hackerone.com | blog | #bug-bounty | #github | #vulnerability-disclosure | #responsible-disclosure | #hackerone
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GitHub Security's bug bounty program turns 10: over $4 million awarded to researchers, eight years on HackerOne, expanded scope, legal safe harbor, and live hacking events along the way.
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · depthfirst.com
Our Approach to Coordinated Vulnerability Disclosure
depthfirst's coordinated disclosure policy: every report is human-verified and includes a PoC and fix guidance; vendors get 30 days to patch, then a 7-day adoption window before publication.
blog · projectzero.google
Feedback and data-driven updates to Google’s disclosure policy
A Google Project Zero announcement on feedback and data-driven updates to Google's vulnerability disclosure policy.
blog · netspi.com
Vulnerability Disclosure Submission Standard?
The author argues the industry lacks a standard vulnerability disclosure channel and proposes RFC2142 mailboxes such as security@ and abuse@ as a simple convention for routing reports.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
Back