- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 27
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 |
| High |
|
$5,000 |
| Medium |
|
$2,000 |
| Low |
|
$250 |
- Safe harbor
-
Full
We consider security research and vulnerability disclosure activities conducted consistent with this policy as “authorized” conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as Cal. Penal Code 502(c).
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
27 assets you may test, 12 excluded.
Web 7
- api.github.com Critical
- classroom.github.com Critical
- education.github.com Critical
- gist.github.com Critical
- github.com Critical
- npmjs.com Critical
- npmjs.org Critical
Desktop and binaries 3
- GitHub CLI High
- GitHub Desktop Critical
- npm CLI High
Wildcard domains 3
- *.githubapp.com Critical
- *.github.net Critical
- *.githubusercontent.com Critical
Hardware and IoT 1
- GitHub Enterprise Server Critical
Products and areas 13
- Copilot Critical
- Copilot Chat on dotcom High
- Copilot Coding Agent Critical
- Copilot for Business Critical
- Copilot Spaces Critical
- Dependabot Critical
- GitHub CSP High
- GitHub Enterprise Cloud Critical
- GitHub Enterprise Cloud with Data Residency (GHEC-DR) Critical
- GitHub for mobile Critical
- GitHub Pages Critical
- GitHub Production Credentials Critical
- GitHub Spark Critical
Out of scope (12)
- Atom
- Electron
- GitHub Classroom Assistant
- blog.github.com
- community.github.com
- enterprise.github.com
- github.blog
- git.io
- http://education.github.com/forum
- shop.github.com
- spectrum.chat
- *.github.io
Rules
What the policy asks of you, and the bug types it won't reward, quoted from GitHub (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Never attempt non-technical attacks such as social engineering, phishing, or physical attacks against our employees, users, or infrastructure.
-
Do not impact other users with your testing, this includes testing vulnerabilities in repositories or organizations you do not own.
-
If you are attempting to find an authorization bypass, you must use accounts you own.
-
Do not intentionally access others' PII.
-
Report the vulnerability *immediately* and do not attempt to access any other data.
-
You must delete all your local, stored, or cached copies of data containing PII as soon as possible.
-
When reporting vulnerabilities you must keep all information on HackerOne.
-
Do not post information to video-sharing or pastebin sites.
-
We ask that you refrain from publicly disclosing details regarding an issue you’ve reported until the fix has been publicly made available.
-
Stop **immediately** if you believe you have affected the availability of our services.
Not accepted
-
Performing distributed denial of service (DDoS) or other volumetric attacks
-
Spamming content
-
Large-scale vulnerability scanners, scrapers, or automated tools which produce excessive amounts of traffic.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Removed: “Severity Guidelines”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
GitHub Security Bug Bounty
Software security researchers are increasingly engaging with internet companies to hunt down vulnerabilities. Our bounty program gives a tip of the hat to these researchers and provides rewards of $10,000 or more for critical vulnerabilities.
You can find more information in our rules, scope, targets, and FAQ sections.
Happy hacking!
Rules
Before you start
-
Check the list of domains that are in scope for the Bug Bounty program and the list of targets for useful information for getting started.
-
Check the list of bugs that have been classified as ineligible. Submissions which are ineligible will likely be closed as
Not Applicable. -
Check the GitHub Changelog for recently launched features.
-
Never attempt non-technical attacks such as social engineering, phishing, or physical attacks against our employees, users, or infrastructure.
-
When in doubt, contact us at
[email protected]. -
By participating in GitHub's Bug Bounty program (the "Program"), you acknowledge that you have read and agree to GitHub's Terms of Service as well as the following:
-
you are not currently a GitHub employee or contractor, were not a GitHub employee or contractor within six months prior to submission, and you did not collaborate on your submission with anyone who was.
-
your participation in the Program will not violate any law applicable to you, or disrupt or compromise any data that is not your own.
-
you are solely responsible for any applicable taxes, withholding or otherwise, arising from or relating to your participation in the Program, including from any bounty payments.
-
GitHub reserves the right to terminate or discontinue the Program at its discretion.
-
Only test for vulnerabilities on sites you know to be operated by GitHub and are in-scope. Some sites hosted on subdomains of
GitHub.comare operated by third parties and should not be tested. -
We cannot reward any individual on any U.S. sanctions list, or any individual residing in any U.S.-sanctioned country or region. For more information, please see https://www.hackerone.com/disclosure-guidelines.
-
Legal safe harbor
Your research is covered by the GitHub Bug Bounty Program Legal Safe Harbor policy. In summary:
- We consider security research and vulnerability disclosure activities conducted consistent with this policy as “authorized” conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as Cal. Penal Code 502(c). We waive any potential DMCA claim against you for circumventing the technological measures we have used to protect the applications in this bug bounty program's scope.
- We want you to coordinate disclosure through our bug bounty program, and don't want researchers put in fear of legal consequences because of their good faith attempts to comply with our bug bounty policy. We cannot bind any third party, so do not assume this protection extends to any third party. If in doubt, ask us before engaging in any specific action you think might go outside the bounds of our policy.
- Because both identifying and non-identifying information can put a researcher at risk, we limit what we share with third parties. We may provide non-identifying substantive information from your report to an affected third party, but only after notifying you and receiving a commitment that the third party will not pursue legal action against you. We will only share identifying information (name, email address, phone number, etc.) with a third party if you give your written permission.
- If your security research as part of the bug bounty program violates certain restrictions in our site policies, the safe harbor terms permit a limited exemption.
Performing your research
-
Do not impact other users with your testing, this includes testing vulnerabilities in repositories or organizations you do not own. If you are attempting to find an authorization bypass, you must use accounts you own.
-
We recommend adding your HackerOne
@wearehackerone.comemail address to any GitHub account that you use to perform security research and testing. If you use multiple GitHub accounts for testing, you can use aliases of your HackerOne email address. Clearly identifying accounts that are associated with bounty research helps our teams to differentiate between possibly malicious activity and that of researchers involved in our Bug Bounty program. Please note that adding your HackerOne email address does not provide any exemptions to our Terms of Service or permit you to act beyond our bounty rules and scope. -
The following are never allowed and are ineligible for reward. We may suspend your GitHub account and ban your IP address for:
- Performing distributed denial of service (DDoS) or other volumetric attacks
- Spamming content
- Large-scale vulnerability scanners, scrapers, or automated tools which produce excessive amounts of traffic.
- Note: We do allow the use of automated tools so long as they do not produce excessive amounts of traffic. For example, running one
nmapscan against one host is allowed, but sending 65,000 requests in two minutes using Burp Suite Intruder is excessive.
- Note: We do allow the use of automated tools so long as they do not produce excessive amounts of traffic. For example, running one
-
Researching denial-of-service attacks is allowed and eligible for rewards only if you follow these rules:
- There are no limits for researching denial of service vulnerabilities against your own instance of GitHub Enterprise Server. We strongly recommend/prefer this method for researching denial of service issues.
- If you choose to test on GitHub proper (i.e.
https://github.com)- Research must be performed in organizations or repositories you own
- Stop immediately if you believe you have affected the availability of our services. Don't worry about demonstrating the full impact of your vulnerability, GitHub's security team will be able to determine the impact.
Handling personally identifiable information (PII)
- Personally identifying information (PII) includes:
- legal and/or full names
- names or usernames combined with other identifiers like phone numbers or email addresses
- health or financial information (including insurance information, social security numbers, etc.)
- information about political or religious affiliations
- information about race, ethnicity, sexual orientation, gender, or other identifying information that could be used for discriminatory purposes
- Do not intentionally access others' PII. If you suspect a service provides access to PII, limit queries to your own personal information.
- Report the vulnerability immediately and do not attempt to access any other data. The GitHub Security team will assess the scope and impact of the PII exposure.
- Limit the amount of data returned from services. For SQL injection, for example, limit the number of rows returned
- You must delete all your local, stored, or cached copies of data containing PII as soon as possible. We may ask you to sign a certificate of deletion and confidentiality agreement regarding the exact information you accessed. This agreement will not affect your bounty reward.
- We may ask you for the usernames and IP addresses used during your testing to assess the impact of the vulnerability
Reporting your vulnerability
- Submissions must include written instructions for reproducing the vulnerability. Submissions without clear reproduction steps or which only include reproduction steps in video form may be ineligible for a reward.
- When reporting vulnerabilities you must keep all information on HackerOne. Do not post information to video-sharing or pastebin sites. Videos and images can be uploaded directly via HackerOne.
- For vulnerabilities involving personally identifiable information, please explain the kind of PII you believe is exposed and limit the amount of PII data included in your submissions. For textual information and screenshots, please only include redacted data in your submission.
- During the course of an investigation, it may take time to resolve the issue you have reported. We ask that you refrain from publicly disclosing details regarding an issue you’ve reported until the fix has been publicly made available.
Receiving your award
- All reward amounts are determined by our severity guidelines.
- In addition to the bounty reward, some reports will also receive a coupon code that can be redeemed for swag items at the GitHub Bug Bounty Merch Shop. For more information about the store, please visit the shop's FAQ page.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- You are free to publish write-ups about your vulnerability, and GitHub will not limit what you write. We may pay out your reward before the vulnerability is patched, so we may ask that you delay publishing to keep other GitHub users safe.
- GitHub is a CVE Numbering Authority (CNA) for GitHub Enterprise Server. Eligible Bug Bounty submissions that affect GitHub Enterprise Server may be assigned CVEs. These CVEs will be shared with submitters via HackerOne and listed in the GitHub Enterprise Server release notes.
- If you would prefer to donate your bounty reward to an established 501(c)(3) charitable organization, GitHub will match your donation. If the bounty has already been processed into your account, it can no longer be donated through HackerOne and is no longer eligible for matching donations. To reduce the likelihood of a bounty being processed before it can be donated, we recommend changing your payment preferences to monthly in your account settings. To donate your reward and have it matched, submit a support ticket to HackerOne with the following information:
- the report ID for which you want to donate the bounty;
- the name and website of the charity you want to donate to;
- that you would like the donation matched using GitHub's process; and
- whether you want to be named as the donor or would prefer to remain anonymous. Keep in mind that we can only attribute the donation to you if the charity allows us to give a name.
Scope
GitHub runs a number of services but only submissions under the following domains are eligible for rewards. Any GitHub-owned domains not listed below are not in scope, not eligible for rewards, and not covered by our legal safe harbor.
github.com
This is our main domain for hosting user-facing GitHub services.. All subdomains under github.com are in-scope except:
blog.github.comcommunity.github.comemail.enterprise.github.comemail.finance.github.comemail.staging.finance.github.comemail.support.github.comemail.verify.github.comgoogle7650dcf6146f04d8.github.comk1._domainkey.github.comk1._domainkey.mcmail.github.commcmail.github.comresources.github.com*.resources.github.comsgmail.github.com*.sgmail.github.comshop.github.comsmtp.github.com*.smtp.github.com
githubassets.com
This is our domain for hosting static assets.. All subdomains under githubassets.com are in-scope
githubusercontent.com
This is our domain for hosting and rendering users' data.. All subdomains under githubusercontent.com are in-scope
githubapp.com
This is our domain for hosting employee-facing services.. All subdomains under githubapp.com are in-scope except:
atom-io.githubapp.comatom-io-staging.githubapp.comemail.enterprise-staging.githubapp.comemail.haystack.githubapp.comreply.githubapp.com
githubwebhooks.net
This is our domain for receiving webhooks for employee-facing services.. All subdomains under githubwebhooks.net are in-scope
github.net
This is our domain for hosting GitHub's internal production services. Many of these services are not accessible from outside our internal network.. All subdomains under github.net are in-scope
npmjs.com
This is the domain for npm's public-facing websites.. All subdomains under npmjs.com are in-scope
npmjs.org
This is the domain for npm's registry, public-facing databases, and APIs.. All subdomains under npmjs.org are in-scope
GitHup VIP Program
We’re stoked to hear you’d like to become a Hacktocat! In order to be eligible to receive an invitation, you must accomplish at least one of the following:
- One critical finding
- Two high findings
- Four medium findings
- Seven low findings
Please note that meeting these criteria does not guarantee an invitation. We reserve the right to extend invitations at our discretion. Researchers do not need to perform any additional steps to receive an invite once they become eligible. We review eligibility and make decisions on candidates on a monthly basis.