BugRater
Early access. This site has moved to bugrater.com.
Programs / GitHub

In brief. GitHub is a bug bounty program on HackerOne. It received 1,144 reports in the 90 days to November 9, 2026, about 28 per in-scope asset. As of Nov 9, 2026. Markdown for agents

NR Unrated

GitHub

GitHub HackerOne
2 more reviews needed for a grade
Read the 1 review
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at GitHub? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 9 Nov 2026.

What it pays, by severity

Critical amount not published 96 reports
High $10,667 avg 309 reports firm
Medium $5,071 avg 457 reports firm
Low $762 avg 794 reports firm

$6,704,833 paid to researchers in total, $163,542 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received
1,144
in 90 days
Resolved
2,206
all time, last one 4 days ago
Participants
1,030
hunters engaged
Response efficiency
34%
below its own targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received, day by day, last 31 days 1,156–1,361
10 Oct 1,156 reports 9 Nov

Response targets it sets itself

First response
1 day
Triage
5 days
Bounty
30 days
Resolution
30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 81 days (411 snapshots): intake down 5 reports; response efficiency down 12 points; 90-day payout down $133,379.

See how this program’s report load compares to others

Reviews

1 published

What the reviews add up to

4.0 / 5 from 1 review

How they rate it

  1. 5 stars0 0%
  2. 4 stars1 100%
  3. 3 stars0 0%
  4. 2 stars0 0%
  5. 1 star0 0%

Against every program on BugRater

  1. Overall4.0 all 2.9
  2. Triage3.0 all 3.0
  3. Communication4.0 all 3.8
  4. Payout5.0 all 1.8
  5. Scope– all 3.8
Hacktivity: GitHub (47 disclosed)
★★★★★ positive

Source: HackerOne Hacktivity (public disclosures) Program: https://hackerone.com/github Disclosed reports analyzed: 47 Bounties: $6,660 avg, $10,000 range, $46,617 total (7 paid) --- Aggregated from publicly disclosed HackerOne reports. Ratings derived from triage timing and bounty data.

via HackerOne reports 47 resubmit yes
Anonymous researcher Oct 1, 2026 Share ↗ 0 helpful
0 comments

Log in to comment

Who this program credits

1,035 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 ahacker1 4,372 110 / 147 75%
2 vaib25vicky 1,702 51 / 105 49%
3 inspector-ambitious 1,657 50 / 68 74%
4 kamil_hism 1,596 54 / 62 87%
5 criticalonly 981 23 / 29 79%
6 r31n 968 22 / 31 71%
7 not-an-aardvark 955 29 / 36 81%
8 yvvdwf 953 20 / 23 87%
9 dev-bio 769 17 / 28 61%
10 vakzz 647 19 / 21 90%
11 archangel 643 9 / 28 32%
12 ajxchapman 617 13 / 13 100%
13 ryotak 610 20 / 29 69%
14 cache-money 597 22 / 31 71%
15 imrerad 555 18 / 25 72%
16 adnanthekhan 537 15 / 27 56%
17 ali_shehab 534 14 / 43 33%
18 indoappsec 484 21 / 48 44%
19 d0xing 462 14 / 20 70%
20 rijalrojan 445 15 / 17 88%
21 joaxcar 439 6 / 15 40%
22 jon_bottarini 430 7 / 15 47%
23 adrianoapj 383 11 / 18 61%
23 nikitastupin 383 14 / 26 54%
25 m0chan 374 17 / 29 59%

Showing the top 25 of 1,035 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 8 Nov 2026.

How people build software

Responsiveness
34% HackerOne’s figure
Swag
Offered
Currency
USD
Submissions
Open
Launched
Apr 2016
Scope entries
197 HackerOne’s count

Scope

54 assets
AssetTypeEligibilityMax severity
*.github.net URL ✓ bounty Critical
*.githubapp.com URL ✓ bounty Critical
*.githubusercontent.com URL ✓ bounty Critical
All Other Scope OTHER ✓ bounty Critical
api.github.com URL ✓ bounty Critical
Show all 54 assets
AssetTypeEligibilityMax severity
classroom.github.com URL ✓ bounty Critical
Code Search OTHER ✓ bounty Critical
Codespaces OTHER ✓ bounty Critical
Copilot OTHER ✓ bounty Critical
Copilot Chat on dotcom OTHER ✓ bounty High
Copilot Coding Agent OTHER ✓ bounty Critical
Copilot for Business OTHER ✓ bounty Critical
Copilot Spaces OTHER ✓ bounty Critical
Dependabot OTHER ✓ bounty Critical
education.github.com URL ✓ bounty Critical
GHES OTHER ✓ bounty Critical
gist.github.com URL ✓ bounty Critical
GitHub CLI DOWNLOADABLE EXECUTABLES ✓ bounty High
GitHub CSP OTHER ✓ bounty High
GitHub Desktop DOWNLOADABLE EXECUTABLES ✓ bounty Critical
GitHub Enterprise Cloud OTHER ✓ bounty Critical
GitHub Enterprise Cloud with Data Residency (GHEC-DR) OTHER ✓ bounty Critical
GitHub Enterprise Importer OTHER ✓ bounty Critical
GitHub Enterprise Server HARDWARE ✓ bounty Critical
GitHub for mobile OTHER ✓ bounty Critical
GitHub Pages OTHER ✓ bounty Critical
GitHub Production Credentials OTHER ✓ bounty Critical
GitHub Spark OTHER ✓ bounty Critical
github.com URL ✓ bounty Critical
http://GitHub.com/CSP URL ✓ bounty Critical
https://gist.github.com URL ✓ bounty Critical
jobs.github.com URL ✓ bounty Critical
lab.github.com URL ✓ bounty Critical
LGTM OTHER ✓ bounty Critical
npm CLI DOWNLOADABLE EXECUTABLES ✓ bounty High
npmjs.com URL ✓ bounty Critical
npmjs.org URL ✓ bounty Critical
Other Applications DOWNLOADABLE EXECUTABLES ✓ bounty Low
semmle.com URL ✓ bounty Critical
semmle.net URL ✓ bounty Critical
*.github.io URL out None
Atom DOWNLOADABLE EXECUTABLES submit only Critical
blog.github.com URL out None
community.github.com URL out None
Electron DOWNLOADABLE EXECUTABLES out None
enterprise.github.com URL out None
git.io URL out None
GitHub Classroom Assistant DOWNLOADABLE EXECUTABLES out None
GitHub Education Community forum OTHER out None
github.blog URL out None
http://education.github.com/forum URL out None
shop.github.com URL out None
speakerdeck.com URL out None
spectrum.chat URL out None

HackerOne lists 197 scope entries. Its public listing groups many assets under one label, so we show identical entries once.