BREAKING AT&T Data Breach: ‘Nearly All’ Wireless Customers Exposed in Massive Hack
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

GitHub Paid Out Over $4 Million via Bug Bounty Program

The code hosting platform GitHub has paid out more than $4 million since the launch of its bug bounty program 10 years ago.

Microsoft-owned code hosting platform GitHub has paid out more than $4 million through its bug bounty program, which the company launched 10 years ago.

GitHub’s bug bounty program passed the $4 million milestone in 2023, when it also paid out the highest single reward to date, $75,000.

The amount was awarded for a vulnerability that allowed access to the environment variables of a production container. The discovery of the flaw prompted GitHub to rotate credentials.

In 2023, the total payout amount exceeded $850,000. It’s worth noting that GitHub’s annual payout has exceeded $800,000 since 2021. 

In addition to rewarding regular vulnerability reports, the company also ran several private bounty engagements last year with members of its VIP program.

“In the coming year, we are looking to improve our processes around payout on validation, work towards the next phase of public disclosures, continue to bring more consistency around private bounties for our community, and offer exclusive training and opportunities for our VIP community,” GitHub said.

Major companies regularly make public the results of their bug bounty programs. Netflix announced recently that it paid out over $1 million since 2016. 

Zoom has paid out $10 million since 2019, and Google paid out roughly $10 million in 2023 alone, which brought the internet giant’s total since 2010 to nearly $60 million. 

Related: Mozilla Launches 0Din Gen-AI Bug Bounty Program

Advertisement. Scroll to continue reading.

Related: Adobe Adds Content Credentials and Firefly to Bug Bounty Program

Related: Microsoft Paid Out $63 Million Since Launch of First Bug Bounty Program 10 Years Ago

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

ICS and OT cybersecurity solutions provider TXOne Networks appoints Stephen Driggers as new CRO

Identity orchestration provider Strata Identity appoints Aldo Pietropaolo as Field CTO

Cybersecurity provider for the aviation industry Cyviation has appointed Eliran Almog as Chief Executive Officer.

More People On The Move

Expert Insights