Bug bounty program · HackerOne
Most upvoted reports47
- #3124517ValidAnalysedArbitrary Read of Another Users private repository without AuthorizationGitHub · Insecure Direct Object Reference · 2025 · High · needs: a user account · IDOR / object reference, Missing authorisation check$10,000276votes
- #1711938ValidGithub Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiGitHub · Access Control · 2023–198votes
- #2579939ValidSAML Signature verification bypass allows logging into any user (with specific conditions)GitHub · Access Control · 2024 · Critical–196votes
- #1901040ValidAuthentication bypass on gist.github.com through SSH CertificatesGitHub · Access Control · 2023$10,000182votes
- #1497169ValidCSRF protection bypass in GitHub Enterprise management consoleGitHub · Cross-Site Request Forgery · 2022$10,000152votes
- #3560256ValidCross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationGitHub · Insecure Direct Object Reference · 2026 · Medium–108votes
- #3713965ValidAble to bypass authorization logic and gain more access then intendedGitHub · No weakness recorded · 2026 · Medium–105votes
- #2501036ValidAccess body and title of Internal Repo Issues in ProjectsGitHub · Information Disclosure · 2024 · Medium–100votes
- #1732595ValidGithub app Privilege Escalation to Administrator/Owner of the OrganizationGitHub · Access Control · 2023–98votes
- #3506183ValidMissing Access Control in MigrationFile allows attacker to upload files to any MigrationGitHub · Insecure Direct Object Reference · 2026 · High–92votes
Subdomains56,442
661 covered by the program's own scope · 0 first seen this week
Roots:github.com 55,670 · 3 in scopegithub.net 330 · 330 in scopegithubapp.com 328 · 328 in scopesemmle.com 63githubassets.com 24semmle.net 18lgtm.com 8githubwebhooks.net 1
159 names
| Name | Scope | First seen |
|---|---|---|
| git.10.github.comgit | Not in the scope | 2026-11-14 |
| types-openapi-github.ae-diff-to-api.github.comapi, git | Not in the scope | 2026-11-14 |
| andlabs-git.github.comgit | Not in the scope | 2026-11-14 |
| antivirus-github.github.comgit | Not in the scope | 2026-11-14 |
| api-git-status.github.comapi, git, monitoring | Not in the scope | 2026-11-14 |
| git.api.github.comapi, git | Not in the scope | 2026-11-14 |
| github.api.github.comapi, git | Not in the scope | 2026-11-14 |
| gitlab.api.github.comapi, git | Not in the scope | 2026-11-14 |
| repos.test.credentials.app.scopes.api.github.comapi, git, test | Not in the scope | 2026-11-14 |
| github-slideshow.ashish1007-ai.github.comgit | Not in the scope | 2026-11-14 |
| git.auth.github.comauth, git | Not in the scope | 2026-11-14 |
| git.classroom.github.comgit | Not in the scope | 2026-11-14 |
| gitlab.classroom.github.comgit | Not in the scope | 2026-11-14 |
| github.com.github.comgit | Not in the scope | 2026-11-14 |
| git.corp.github.comgit, internal | Not in the scope | 2026-11-14 |
| covid19-github.github.comgit | Not in the scope | 2026-11-14 |
| covid19-repo.github.comgit | Not in the scope | 2026-11-14 |
| github.covid19.github.comgit | Not in the scope | 2026-11-14 |
| covid19github.github.comgit | Not in the scope | 2026-11-14 |
| covid19repo.github.comgit | Not in the scope | 2026-11-14 |
| dummy-git-url.github.comgit | Not in the scope | 2026-11-14 |
| git.education.github.comgit | Not in the scope | 2026-11-14 |
| gitlab.education.github.comgit | Not in the scope | 2026-11-14 |
| git.enterprise.github.comgit | Not in the scope | 2026-11-14 |
| git.gist.github.comgit | Not in the scope | 2026-11-14 |
| gitlab.gist.github.comgit | Not in the scope | 2026-11-14 |
| git.github.comgit | Not in the scope | 2026-11-14 |
| git-antivirus.github.comgit | Not in the scope | 2026-11-14 |
| git-ashish.github.comgit | Not in the scope | 2026-11-14 |
| gitcoin.com.git-coin-foundation-dao.github.comgit | Not in the scope | 2026-11-14 |
| git-cola.github.comgit | Not in the scope | 2026-11-14 |
| git-commit-notifier.github.comgit | Not in the scope | 2026-11-14 |
| git-covid19.github.comgit | Not in the scope | 2026-11-14 |
| git-ferronrsmith.github.comgit | Not in the scope | 2026-11-14 |
| git-for-windows.github.comgit | Not in the scope | 2026-11-14 |
| git-ifs.github.comgit | Not in the scope | 2026-11-14 |
| git-lfs.github.comgit | Not in the scope | 2026-11-14 |
| git-tfs.github.comgit | Not in the scope | 2026-11-14 |
| git-town.github.comgit | Not in the scope | 2026-11-14 |
| git-virus.github.comgit | Not in the scope | 2026-11-14 |
| antivirus.git.github.comgit | Not in the scope | 2026-11-14 |
| deploy.app.git.github.comgit | Not in the scope | 2026-11-14 |
| build.git.github.comci, git | Not in the scope | 2026-11-14 |
| covid19.git.github.comgit | Not in the scope | 2026-11-14 |
| deploy.my-app.git.github.comgit | Not in the scope | 2026-11-14 |
| acme.semsource.git.github.comgit | Not in the scope | 2026-11-14 |
| sigmavirus24.git.github.comgit | Not in the scope | 2026-11-14 |
| stash.git.github.comgit | Not in the scope | 2026-11-14 |
| virus.git.github.comgit | Not in the scope | 2026-11-14 |
| git99999.github.comgit | Not in the scope | 2026-11-14 |
| gitea.github.comgit | Not in the scope | 2026-11-14 |
| github.github.comgit | Not in the scope | 2026-11-14 |
| github-actions.github.comgit | Not in the scope | 2026-11-14 |
| github-antivirus.github.comgit | Not in the scope | 2026-11-14 |
| github-api.github.comapi, git | Not in the scope | 2026-11-14 |
| git-governance.github-app.github.comgit | Not in the scope | 2026-11-14 |
| github-covid19.github.comgit | Not in the scope | 2026-11-14 |
| github-gist.github.comgit | Not in the scope | 2026-11-14 |
| github-oauth.github.comauth, git | Not in the scope | 2026-11-14 |
| github-server-pool.github.comgit | Not in the scope | 2026-11-14 |
| antivirus.github.github.comgit | Not in the scope | 2026-11-14 |
| ci.github.github.comci, git | Not in the scope | 2026-11-14 |
| json.github.github.comgit | Not in the scope | 2026-11-14 |
| mail1.github.github.comgit, mail | Not in the scope | 2026-11-14 |
| media.github.github.comgit | Not in the scope | 2026-11-14 |
| npm.github.github.comgit | Not in the scope | 2026-11-14 |
| sales-enablement.github.github.comgit | Not in the scope | 2026-11-14 |
| sigmavirus24.github.github.comgit | Not in the scope | 2026-11-14 |
| static.github.github.comgit | Not in the scope | 2026-11-14 |
| github4bhavin.github.comgit | Not in the scope | 2026-11-14 |
| gitlab.github.comgit | Not in the scope | 2026-11-14 |
| git.help.github.comgit | Not in the scope | 2026-11-14 |
| hewei-github.github.comgit | Not in the scope | 2026-11-14 |
| hg-git.github.comgit | Not in the scope | 2026-11-14 |
| github-lb3a-cp1-prd.iad.github.comgit | Not in the scope | 2026-11-14 |
| github-lb3b-cp1-prd.iad.github.comgit | Not in the scope | 2026-11-14 |
| github-lb3c-cp1-prd.iad.github.comgit | Not in the scope | 2026-11-14 |
| github-lb3d-cp1-prd.iad.github.comgit | Not in the scope | 2026-11-14 |
| git.io.github.comgit | Not in the scope | 2026-11-14 |
| github.io.github.comgit | Not in the scope | 2026-11-14 |
| daniel-sigmavirus-x.github.io.github.comgit | Not in the scope | 2026-11-14 |
| lettox.github.io.github.comgit | Not in the scope | 2026-11-14 |
| git.lab.github.comgit | Not in the scope | 2026-11-14 |
| gitlab.lab.github.comgit | Not in the scope | 2026-11-14 |
| virt-git-sync.mathianasj.github.comgit | Not in the scope | 2026-11-14 |
| my-repo.github.comgit | Not in the scope | 2026-11-14 |
| myang-git.github.comgit | Not in the scope | 2026-11-14 |
| git.mycompany.github.comgit | Not in the scope | 2026-11-14 |
| github.mycompany.github.comgit | Not in the scope | 2026-11-14 |
| github-actions.noreply.github.comgit | Not in the scope | 2026-11-14 |
| repo-name.org-name.github.comgit | Not in the scope | 2026-11-14 |
| repo.org.github.comgit | Not in the scope | 2026-11-14 |
| repo-name.orgoruser.github.comgit | Not in the scope | 2026-11-14 |
| repo.owner.github.comgit | Not in the scope | 2026-11-14 |
| pinstinct.github.io.pinstinct.github.comgit | Not in the scope | 2026-11-14 |
| repo-docker.pkg.github.comgit, tools | Not in the scope | 2026-11-14 |
| poly-repo.github.comgit | Not in the scope | 2026-11-14 |
| svn.private.github.comgit, internal | Not in the scope | 2026-11-14 |
| project-repo.github.comgit | Not in the scope | 2026-11-14 |
| rendang-github.github.comgit | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.