Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Git bug bounty programs

git-scm.com Updated

Git runs one public program: a Sorona bug bounty paying up to $6,000.

Top reward
$6,000
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Git runs.

  • Git

    Sorona · Bug bounty

    Open

    Top reward

    $6,000
    Critical
    –
    High
    $6,000
    Medium
    $2,500
    Low
    $313
    Safe harbor
    Partial
    KYC
    Required
    First response
    4 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 6 excluded.

  • https://git-scm.com

    Web

  • Credential helpers and URL parsing, the machinery that decides which host a stored token gets handed to

    Products and areas

  • Everything git does with a repository nobody vetted: the fetch transport, the object store it writes into, and the checkout that lands files on disk

    Products and areas

  • File disclosure as well as code execution: the Pages scope line accepts reading arbitrary files during the build where that discloses sensitive information

    Products and areas

  • Pack and index handling: delta chains, .idx and .pack bounds checks, and the memory-safety surface beneath them

    Products and areas

  • Path handling on case-insensitive and Unicode-normalising filesystems such as NTFS and APFS, where two distinct names collapse into one

    Products and areas

  • Protocol v2 and the rest of the wire protocol the fetch path speaks to a server it does not control

    Products and areas

  • Repository-controlled configuration that a clone carries in with it, including .gitmodules and submodule URLs, .gitattributes with its clean, smudge and filter machinery, and anything dropped inside .git

    Products and areas

  • The declaration is GitHub's, since the Git project pays nothing itself: the GitHub Pages asset lists vulnerabilities in the command-line Git tools when cloning or checking out repositories as an eligible submission, and the GitHub Desktop asset lists code execution without user interaction when cloning or fetching a malicious repository. Both assets are bounty-eligible at critical severity

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything that requires the victim to run a non-default configuration that GitHub does not use

  • Awards are gated on sanctions screening, so a reporter who cannot clear it will not be paid

  • Bugs in third-party Jekyll plugins rather than in git itself or in GitHub's build pipeline

  • Denial of service against GitHub's build infrastructure by volume rather than by defect

  • Git bugs with no demonstrated route to code execution or file disclosure through a GitHub asset, however real the bug is upstream

  • Individual GitHub Pages sites under *.github.io, which the program places explicitly out of scope

Recent changes

Reward and scope changes across every Git program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Git products, from the NVD.

Search NVD
  • CVE-2025-48384 High

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializ

  • CVE-2024-32465 High

    Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned b

  • CVE-2024-32021 Low

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks t

  • CVE-2024-32020 Low

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user

  • CVE-2024-32004 High

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted so

  • CVE-2023-29007 High

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT

  • CVE-2023-25652 High

    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2

  • CVE-2023-22490 Medium

    Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory its

About this page

This page gathers every public program listed under git-scm.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.