sb-eu logo
Story image

GitHub boosts bug bounty program & payouts in 2017 with more to come this year

19 Mar 2018

GitHub’s Security Bug Bounty program paid out more than US$166,000 in 2017 after a significant payout revamp that doubled amounts across the board.

Last month the company marked the fourth year of its program and it says 2017 was its ‘biggest year yet’.

It reviewed and triaged 840 bug submissions, or which 121 were resolved and rewarded. The average payout netted bug reporters US$1376. 

The company says the numbers represent a 15% increase in valid bug reports compared to 48 of 795 incidents resolved in 2016.

GitHub senior manager of security engineering Greg Ose says in a blog post that the total reward payouts rose to $166,495 in 2017 – up from $95,300 in 2016.

“We attribute this to the increased number of valid reports and in October we took time to re-evaluate our payout structure. Corresponding with HackerOne's Hack the World competition, we doubled our payout amounts across the board, bringing our minimum and maximum payouts to $555 and $20,000, bringing our bug bounty in line with the industry's top programs.”

GitHub also conducted a number of other initiatives to boost the Security Bug Bounty program.

One of these was the introduction of GitHub enterprise, which allowed researchers to look at areas specific to enterprise or applications not exposed on GitHub.

“A number of reports impacting our enterprise authentication methods prompted us to not only focus on this internally, but also identify how we could engage researchers to focus on this functionality,” Ose explains.

The company also offered one researcher a grant to research a specific feature or areas of application. Bug bounty rewards also applied.

“During the beginning of the year, we identified a researcher with specialty in assessing troublesome enterprise authentication methods. We reached out and launched our first researcher grant. We couldn't have been happier with the results. It provided a depth of expertise and review that was well worth the extra monetary incentive,” Ose says.

Off the back of its GitHub for Business launch, the company rolled out private bug bounties through a private program on HackerOne.

“We reached out to all researchers who had previously participated in our program and allowed them access to this functionality before its public launch. This added to our internal pre-ship security assessments with review by external researchers and helped us identify and remediate issues before general exposure. With the extra review, we were able to limit the impact of vulnerabilities in production while also providing fresh code and functionality for researchers to look into.”

Finally, the company has continued to develop its HackerOne API client and internal improvements to triage and implement submissions from its bounty reporters.

For the year ahead Ose says, “We'll be launching more private bounties and research grants to gain focus on specific features both before and after they publicly launch. Later in the year, we'll announce additional promotions to continue to keep researchers interested and excited to participate.”

Story image
Check Point acquires Odo Security to bolster remote security offering
The deal will integrate Odo’s remote access software with Check Point’s Inifinity architecture, bolstering the latter company’s remote security capabilities in a time where working and learning from home has become the norm, and looks to largely remain that way in the near future.More
Story image
Phishing scam imitates SharePoint & OneNote for nefarious clicks
Sophos researchers say that the attackers take a slightly different approach to the standard ‘fake login’ phishing email.More
Story image
75% of IT execs 'worried' about being targeted in cyber-attack
A new report from ConnectWise has shed light on the widespread concern about cyber-attacks, with 91% of SMB executives considering a move to an MSP if it provided the 'right' solution.More
Story image
Interview: Check Point profiles 5 battles that SOC teams face in 2020
Security operations centres (SOCs) are often the first lines of defence.More
Story image
High-tech heist: why fending off ransomware attacks is more challenging than ever in 2020
The COVID-19 crisis has unleashed a wave of sophisticated and disruptive ransomware attacks, and the onus is on businesses to ramp up their security measures if they’re to avoid falling victim, writes Attivo Networks regional director for A/NZ Jim Cook.More
Story image
Exabeam and Code42 partner up to launch insider threat solution
The solution will give customers a fuller picture of their environment, and will leverage automated incident response to obstruct insider threat before data loss occurs.More