GitHub Community
Hacking for Good: A Behind-the-Scenes Look at GitHub’s Bug Bounty Program 👩🏾💻 #154874
Replies: 2 comments 2 replies
-
|
GitHub’s Bug Bounty Program thrives because of passionate researchers who work together to strengthen security. Whether you’re just starting or a seasoned hunter, we’re excited to welcome you to our community! 🛡️🚀 💬 Have questions for our Bug Bounty team? Drop them in the comments below—we’d love to hear from you! |
Beta Was this translation helpful? Give feedback.
-
|
I have someone who has been remotely cyberstalking me for a year now no matter what I do. I believe they're using Android studio. All of my devices have been used as an IP camera. Is there anyone who could help me to stop this? I don't speak Linux or know how to code. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @beeroma, 👋🏾 We really appreciate you flagging this but I do have to note that the only way we at GitHub can help is if this person is using GitHub to harass you. If this is the case, the best route to get this to the proper GitHub team is to use our abuse reporting tools. Here's all the info: If the person isn't using GitHub to harass you, I'm sorry to say that there isn't much we can do on our end. I did do a quick Google search on my own and found the following resource that may help: https://www.esafety.gov.au/key-topics/staying-safe/cyberstalking. Thank you! |
Beta Was this translation helpful? Give feedback.
-
Bug bounty hunting is more than just finding vulnerabilities—it’s about collaboration, problem-solving, and making the digital world safer. At GitHub, the Bug Bounty Program is built on transparency, trust, and a global community of security researchers 🤝.
That’s why I’m super excited that we got the chance to interview @shilpakum, a Senior Product Security Engineer on GitHub’s Bug Bounty team!
In this interview, we explore the excitement of working with security experts worldwide, Shilpa’s journey into cybersecurity 🔐, and the challenge of building a trusted community. We also tackle common misconceptions—like the myth that only experts can start hacking—and share top tips for newcomers.
Whether you're an experienced hunter or just getting started, this conversation is packed with insights to inspire you! 🚀
Q: What do you enjoy most about managing the Bug Bounty Program, and what’s been one of the most rewarding parts of your role?
I love working alongside a diverse and skilled global network of security researchers. Every day, I learn from their fresh perspectives, innovative strategies, and technical expertise—all of which help strengthen GitHub’s security.
It’s incredibly rewarding to foster a community built on collaboration, transparency, and mutual respect. When researchers feel valued, they’re more motivated to contribute high-quality findings. Building and maintaining that sense of partnership and trust is something I take great pride in.
Q: How did your journey in the cybersecurity field begin? Any mentors or experiences that shaped your career?
My passion for cybersecurity started during my master’s program, where my advisor introduced me to hands-on labs focused on OWASP Top 10 vulnerabilities. That experience was a turning point—understanding how application-level vulnerabilities work, how they’re exploited, and how to mitigate them ignited my curiosity.
Later, while working on commercial applications, I realized security can’t be an afterthought. It has to be embedded throughout the development lifecycle. That realization deepened my passion, and bug bounties became the perfect outlet to apply my skills, solve complex problems, and make a real-world impact.
Q: What are some common misconceptions about bug bounty programs?
“I need to be a hacking expert to start” Many new researchers assume this, but from what I’ve seen, plenty of successful hunters begin with just a basic grasp of web security and build their skills over time.
“Any bugs will be accepted and rewarded” Bug bounty programs have strict scopes, rules, and severity guidelines. A quirky UI bug won’t qualify unless it impacts security. Our scope and rules help researchers focus on valid submissions.
“The severity or impact of the bug wasn’t evaluated properly” Researchers sometimes feel that the severity or impact of their submitted bugs has not been assessed accurately.
At GitHub, we’re committed to transparency and have set out well-defined reward guidelines along with examples. In our FAQ, we also note how we determine the severity and payout of the reported vulnerability which includes overall business impact, complexity of successfully exploiting the vulnerability, potential exposure as well as percentage of impacted users and systems. Additionally, at least two GitHub security engineers agree on the severity and amount before a payout is made.
Q: What makes GitHub’s Bug Bounty Program stand out from other platforms?
What sets GitHub’s bug bounty program apart is its focus on delivering a standout experience for researchers. With 10 years of operation, it offers a broad and well-defined scope, ensuring clarity and ample opportunities to hunt.
It is a program built on decades of experience, rewarding skill and fostering a top-tier community.
Q: Do you have any tips or advice for someone new to the Bug Bounty Program who wants to get involved but isn’t sure where to start?
Q: How do you celebrate or acknowledge the contributions of the bug hunters in the community?
We spotlight researchers through interviews, reward top contributors with bonuses, and offer exclusive swag. Researchers assigned a CVE can initiate limited disclosure on HackerOne to showcase their findings. Plus, we let researchers verify fixes for their reported bugs, reinforcing a true partnership.
Some of the spotlight interviews that we have done in the past:
Q: What strategies do you use to encourage diversity and inclusivity in the Bug Bounty community?
GitHub fosters diversity and inclusion in our community and constantly looks for opportunities to encourage this further. For the last 2 years GitHub partners with HackerOne, CapitalOne and Salesforce to host an event, designed to encourage women to learn about hacking and cybersecurity in a friendly environment.
Q: How do you engage with the researcher community to ensure that they have the right resources and guidance for submitting bugs?
Our public website clearly outlines how researchers can submit a vulnerability along with all the information outlining the scope, rewards, target, rules of engagement etc. GitHub’s HackerOne profile also outlines similar details.
In case anything is not clear or in doubt we encourage researchers to contact us at [email protected]!
Beta Was this translation helpful? Give feedback.
All reactions