Skip to content
Sign in

Bug bounty program

GI

GitHub

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
27
Disclosed reports
47
Subdomains
56,442
Vendor on CyberSIXT
GitHub (168 CVEs, 0 exploited)

Most upvoted reports47

All reports
Most upvoted reports of GitHub
ReportWeaknessDisclosedBountyVotes
Arbitrary Read of Another Users private repository without AuthorizationAnalysed#3124517Insecure Direct Object Reference2025-09-23$10,000276
Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiAnalysed#1711938Access Control2023-01-26–198
SAML Signature verification bypass allows logging into any user (with specific conditions)Analysed#2579939Access Control2024-10-10–196
Authentication bypass on gist.github.com through SSH CertificatesAnalysed#1901040Access Control2023-04-20$10,000182
CSRF protection bypass in GitHub Enterprise management consoleAnalysed#1497169Cross-Site Request Forgery2022-04-13$10,000152
Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationAnalysed#3560256Insecure Direct Object Reference2026-05-19–108
Able to bypass authorization logic and gain more access then intendedAnalysed#3713965No weakness recorded2026-07-15–105
Access body and title of Internal Repo Issues in ProjectsAnalysed#2501036Information Disclosure2024-07-31–100
Github app Privilege Escalation to Administrator/Owner of the OrganizationAnalysed#1732595Access Control2023-01-13–98
Missing Access Control in MigrationFile allows attacker to upload files to any MigrationAnalysed#3506183Insecure Direct Object Reference2026-03-05–92

Subdomains56,442

Root:semmle.net
Scope
Name suggests
First seen:This month
Text fileClear filters0 names

No subdomain matches

Remove a filter or pick another root.

Clear filters

661 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in