Skip to content

Bug bounty program · HackerOne

GitHub

Open on HackerOne See this on the Atlas

Yespays bounties

27assets in scope

47disclosed reports 56,442subdomains

Most upvoted reports47

#3124517ValidAnalysedArbitrary Read of Another Users private repository without AuthorizationGitHub · Insecure Direct Object Reference · 2025 · High · needs: a user account · IDOR / object reference, Missing authorisation check$10,000276votes
#1711938ValidGithub Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiGitHub · Access Control · 2023–198votes
#2579939ValidSAML Signature verification bypass allows logging into any user (with specific conditions)GitHub · Access Control · 2024 · Critical–196votes
#1901040ValidAuthentication bypass on gist.github.com through SSH CertificatesGitHub · Access Control · 2023$10,000182votes
#1497169ValidCSRF protection bypass in GitHub Enterprise management consoleGitHub · Cross-Site Request Forgery · 2022$10,000152votes
#3560256ValidCross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationGitHub · Insecure Direct Object Reference · 2026 · Medium–108votes
#3713965ValidAble to bypass authorization logic and gain more access then intendedGitHub · No weakness recorded · 2026 · Medium–105votes
#2501036ValidAccess body and title of Internal Repo Issues in ProjectsGitHub · Information Disclosure · 2024 · Medium–100votes
#1732595ValidGithub app Privilege Escalation to Administrator/Owner of the OrganizationGitHub · Access Control · 2023–98votes
#3506183ValidMissing Access Control in MigrationFile allows attacker to upload files to any MigrationGitHub · Insecure Direct Object Reference · 2026 · High–92votes

Subdomains56,442

661 covered by the program's own scope · 0 first seen this week

Roots:github.com 55,670 · 3 in scope github.net 330 · 330 in scope githubapp.com 328 · 328 in scope semmle.com 63 githubassets.com 24 semmle.net 18 lgtm.com 8 githubwebhooks.net 1

ScopeNo domain scope published

Name suggestsAnything

First seenAny time

This list as text Clear

No subdomain matches

Clear a filter or pick another root.

Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.