Skip to content
Sign in

Bug bounty program

GI

GitHub

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
27
Disclosed reports
47
Subdomains
56,442

Most upvoted reports47

All reports
Most upvoted reports of GitHub
ReportWeaknessDisclosedBountyVotes
Arbitrary Read of Another Users private repository without AuthorizationAnalysed#3124517Insecure Direct Object Reference2025-09-23$10,000276
Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api#1711938Access Control2023-01-26–198
SAML Signature verification bypass allows logging into any user (with specific conditions)#2579939Access Control2024-10-10–196
Authentication bypass on gist.github.com through SSH Certificates#1901040Access Control2023-04-20$10,000182
CSRF protection bypass in GitHub Enterprise management console#1497169Cross-Site Request Forgery2022-04-13$10,000152
Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification#3560256Insecure Direct Object Reference2026-05-19–108
Able to bypass authorization logic and gain more access then intended#3713965No weakness recorded2026-07-15–105
Access body and title of Internal Repo Issues in Projects#2501036Information Disclosure2024-07-31–100
Github app Privilege Escalation to Administrator/Owner of the Organization#1732595Access Control2023-01-13–98
Missing Access Control in MigrationFile allows attacker to upload files to any Migration#3506183Insecure Direct Object Reference2026-03-05–92

Subdomains56,442

Root:semmle.com
Scope
Name suggests:Source code
First seen
Text fileClear filters4 names
Subdomains of GitHub
NameScopeFirst seen
git.semmle.comgitNot in the scope2026-11-14
svn.semmle.comgitNot in the scope2026-11-14
www.git.semmle.comgitNot in the scope2026-11-14
000.000.000.svn.git.semmle.comgitNot in the scope2026-11-14

661 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in