GitHub sets up bug bounty program

GitHub is the latest service to announce that they have started a security bug bounty program.

“The idea is simple: hackers and security researchers find and report vulnerabilities through our responsible disclosure process. Then, to recognize the significant effort that these researchers often put forth when hunting down bugs, we reward them with some cold hard cash,” they stated in a blog post on Thursday.

Rewards will range from $100 up to $5000, and the actual amounts are to be decided by the team on a case to case basis, and by taking in consideration a number of factors.

“For example, if you find a reflected XSS that is only possible in Opera, and Opera is <2% of our traffic, then the severity and reward will be lower. But a persistent XSS that works in Chrome, at >60% of our traffic, will earn a much larger reward,” they explained.

Initially, bug bounties will be limited to vulnerabilities discovered in GitHub’s main website (Github.com), the GitHub API, and GitHub Gist, a service for sharing snippets of code or other text content.

The team says that they will respond as quickly as possible to submissions, and keep the submitter updated as they work on a bug fix. “We will not take legal action against you if you play by the rules,” they made sure to add.