Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Restructuring GitHub's bug bounty program

github.blog

Post reply on HN
Print view View original

1–10 of 38 posts

Re: Restructuring GitHub's bug bounty program

#4

Post by toomuchtodo »

dinkelberg wrote: post #2

So if the "wrong" person finds a critical vulnerability in GitHub, the payout is capped at $10,000. Might reduce the likelihood of it being submitted to the bug bounty program.

It might, but as someone who has to review public vulnerability reports for a much less popular website, I completely understand why they’re building a vouch program to dissuade slop reports. One would presume their internal team is using frontier models for red team agent scanning against potential attack surface, and so this is a potential risk they’re willing to take.

Tragedy of the commons that someone who hasn’t passed the filter yet might have their payout limited.

Vouch - https://news.ycombinator.com/item?id=46930961 - February 2026 (486 comments)

Re: Restructuring GitHub's bug bounty program

#6

Post by super256 »

toomuchtodo wrote: post #4
dinkelberg wrote: post #2

So if the "wrong" person finds a critical vulnerability in GitHub, the payout is capped at $10,000. Might reduce the likelihood of it being submitted to the bug bounty program.

It might, but as someone who has to review public vulnerability reports for a much less popular website, I completely understand why they’re building a vouch program to dissuade slop reports. One would presume their internal team is using frontier models for red team agent scanning against potential attack surface, and so this is a potential risk they’re willing to take. Tragedy of the commons that someone who hasn’t…

tbh hackerone should just implement a +/- reputation points feature on researcher profiles. Like, the researcher submits a slop report to GitHub via H1, GitHub looks at it and identifies it as slop, GitHub presses the -rep button on reaearcher profile which bans them from submitting to GitHub on H1 again and makes their rep points minus 1. Companies should be able to configure you need at least 10 rep points to receive payouts. Only specific (by H1 chosen) companies can +/- rep.

So, researchers first need to collect some positive rep. But the rep points are global, so once you have fixed a few bugs for Google, you've gotten enough +rep that you can also receive stuff at GitHub.

Oh, and ID check when signing up at H1.

Long term all beg bounty submitters would be banned for pretty much all of tech.

Re: Restructuring GitHub's bug bounty program

#8

Post by applfanboysbgon »

I mean, this is just a "fuck you", right? "Because there's a lot of LLM spam, we've decided that some researchers will get 1/4th as much pay for reporting the same bug as others, even if they didn't use LLMs". If anything this will have the opposite of the intended effect -- this strongly discourages humans who aren't part of the VIP program from reporting bugs they find to Github, so you'll probably see a higher ratio of LLM spam in the future. And don't be surprised if those bugs get sold elsewhere...

Re: Restructuring GitHub's bug bounty program

#9

Post by applfanboysbgon »

toomuchtodo wrote: post #4
dinkelberg wrote: post #2

So if the "wrong" person finds a critical vulnerability in GitHub, the payout is capped at $10,000. Might reduce the likelihood of it being submitted to the bug bounty program.

It might, but as someone who has to review public vulnerability reports for a much less popular website, I completely understand why they’re building a vouch program to dissuade slop reports. One would presume their internal team is using frontier models for red team agent scanning against potential attack surface, and so this is a potential risk they’re willing to take. Tragedy of the commons that someone who hasn’t…

How does decreasing pay for humans discourage slop reports, exactly?
Post reply on HN