Git

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (through GitHub Pages or GitHub Desktop) │ $10,000 │ $11,000 High │ $5,000 │ $6,000 Medium │ $2,000 │ $2,500 Low │ $250 │ $313 Submit a vulnerability CVE history 3 Last 12 months 68 Lifetime Code execution 40 % Memory safety 25 % Parsing/validation 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Git is the substrate of the entire industry: every forge, every CI system and every developer laptop runs it, and it is the one program in the toolchain that parses fully attacker-controlled input by design, because a repository is a hostile data structure that git is asked to unpack, walk and check out. It is also the classic everyone-depends-on-it, nobody-funds-it case: the Git project has no vendor, no security budget and no bounty, and its own security list pays nothing. GitHub is the exception: it names git-tool defects as eligible submissions on two of its bounty-paying assets, so a malicious-repository bug demonstrated through the GitHub Pages build or through GitHub Desktop is payable at $250 for low up to $10,000 for critical, against an average award around $617. sorona.xyz adds 1.25x on top of whatever GitHub pays, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~4 days First response ~11 days Triage ~44 days Bounty In scope The declaration is GitHub's, since the Git project pays nothing itself: the GitHub Pages asset lists vulnerabilities in the command-line Git tools when cloning or checking out repositories as an eligible submission, and the GitHub Desktop asset lists code execution without user interaction when cloning or fetching a malicious repository. Both assets are bounty-eligible at critical severity Everything git does with a repository nobody vetted: the fetch transport, the object store it writes into, and the checkout that lands files on disk Repository-controlled configuration that a clone carries in with it, including .gitmodules and submodule URLs, .gitattributes with its clean, smudge and filter machinery, and anything dropped inside .git Pack and index handling: delta chains, .idx and .pack bounds checks, and the memory-safety surface beneath them Protocol v2 and the rest of the wire protocol the fetch path speaks to a server it does not control Path handling on case-insensitive and Unicode-normalising filesystems such as NTFS and APFS, where two distinct names collapse into one Credential helpers and URL parsing, the machinery that decides which host a stored token gets handed to File disclosure as well as code execution: the Pages scope line accepts reading arbitrary files during the build where that discloses sensitive information Out of scope Git bugs with no demonstrated route to code execution or file disclosure through a GitHub asset, however real the bug is upstream Anything that requires the victim to run a non-default configuration that GitHub does not use Denial of service against GitHub's build infrastructure by volume rather than by defect Individual GitHub Pages sites under *.github.io , which the program places explicitly out of scope Bugs in third-party Jekyll plugins rather than in git itself or in GitHub's build pipeline Awards are gated on sanctions screening, so a reporter who cannot clear it will not be paid Most-valued findings Code execution during the GitHub Pages build triggered purely by cloning or checking out an attacker-authored repository, the highest-value shape here and the one the scope line names Zero-interaction code execution when GitHub Desktop clones or fetches a malicious repository, the second named route into the same reward ladder Memory-safety defects in pack, index or delta parsing that a crafted repository can reach during a normal fetch Path traversal or symlink handling that writes into .git or outside the working tree on a checkout Credential helper or URL parsing flaws that hand a stored token to a host the user never intended to reach Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The Git project pays nothing itself, so a finding is only payable once it is demonstrated through a GitHub asset The two accepted routes are arbitrary code execution during the GitHub Pages build process via the command-line Git tools on clone or checkout, and code execution without user interaction when GitHub Desktop clones or fetches a hostile repository A git CVE reported in the abstract, with no demonstrated path through a GitHub asset, is not a bounty-eligible submission The bug has to work on a configuration GitHub actually runs; anything that needs a non-default setting GitHub does not use will not be paid Keep every detail of the report on HackerOne while it is open rather than posting it elsewhere Program stats 2,132 Reports resolved $6.5M Bounties paid 62% Response efficiency Disclosure Coordinated through GitHub on HackerOne. GitHub states plainly that you are free to publish a write-up about your own vulnerability and that it will not limit what you write, so the only real constraint is that the report stays on HackerOne while it is being fixed. sorona.xyz holds your finding and lines the write-up up behind GitHub's fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability