GitHub Bug Bounty
github.com, GitHub Enterprise, Actions, Packages, auth. Excellent docs and a high bar.
Tags: vendor, vrp, ci
- Program model
- First-party VRP
- Regions
- Global
- Payout
- USD; published table, extras for Actions/Enterprise
Specialties: web, auth, ci, supply-chain
How to approach it
Scope is explicit. Actions supply-chain and auth issues have been the interesting half for years.
- Do not scan other users' repos. The policy is precise about what you may touch.
- Enterprise Server in-scope versions are listed. Stay on those.