Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Restructuring GitHub's bug bounty program

github.blog

Post reply on HN
Print view View original

11–20 of 38 posts

Re: Restructuring GitHub's bug bounty program

#11

Post by dfedbeef »

applfanboysbgon wrote: post #9
toomuchtodo wrote: post #4

Earlier quoted context omitted.

It might, but as someone who has to review public vulnerability reports for a much less popular website, I completely understand why they’re building a vouch program to dissuade slop reports. One would presume their internal team is using frontier models for red team agent scanning against potential attack surface, and so this is a potential risk they’re willing to take. Tragedy of the commons that someone who hasn’t…

How does decreasing pay for humans discourage slop reports, exactly?

It discourages all reports, so you get the reduced slop reports for free.

Re: Restructuring GitHub's bug bounty program

#12

Post by applfanboysbgon »

dfedbeef wrote: post #11
applfanboysbgon wrote: post #9

Earlier quoted context omitted.

How does decreasing pay for humans discourage slop reports, exactly?

It discourages all reports, so you get the reduced slop reports for free.

Does it, though? It discourages humans from putting in effort because their time will not be rewarded. But the slop reports were not the result of time nor effort. I'd rather expect changing a payout from $1k to $250 doesn't meaningfully move the needle on someone spending two minutes prompting their OpenClaw to spam bug bounties. Especially since the reports you actually want to filter out are the sub-50-IQ reports that were always going to get $0 either way.

Re: Restructuring GitHub's bug bounty program

#13

Post by jonoc »

fragmede wrote: post #10

[flagged]

I get the joke, but I don’t think GitHub is treating one type of person as inherently more deserving. They’re paying for signal and reduced triage cost as well as the vulnerability itself. AI makes it incredibly cheap to flood them with plausible-looking false positives, while their investigation capacity is finite.

Re: Restructuring GitHub's bug bounty program

#14

Post by wxw »

> We’re formalizing a permanent private/invite-only VIP program for qualified researchers who consistently deliver high-quality, high-impact work.

> VIP program bounty table:

  Severity  Payout
  --------  --------
  Low       $1,000
  Medium    $7,500
  High      $20,000
  Critical  $30,000+
> We are adjusting our public program rates to accommodate this shift in focus towards quality of relationships and findings over quantity of reports. We are also updating to static payouts—a single, clear number per severity level, rather than a wide range.

> Our new public program bounty table:

  Severity  Payout
  --------  -------
  Low       $250
  Medium    $2,000
  High      $5,000
  Critical  $10,000
> To reduce the volume of low-effort and AI-generated reports, we’re implementing a HackerOne signal requirement on the public program.

Re: Restructuring GitHub's bug bounty program

#16

Post by darkamaul »

I believe the changes here make a lot of sense because, most of the time, your best bugs are not your first ones

Anyone can point an LLM to a code base and ask to find a vulnerability - and the initial set of findings is going to be rather lame.

Encouraging researchers to stick to a target and to report 7 lows before getting in will probably make their contributions more valuable.

Re: Restructuring GitHub's bug bounty program

#18

Post by Synthetic7346 »

super256 wrote: post #6
toomuchtodo wrote: post #4

Earlier quoted context omitted.

It might, but as someone who has to review public vulnerability reports for a much less popular website, I completely understand why they’re building a vouch program to dissuade slop reports. One would presume their internal team is using frontier models for red team agent scanning against potential attack surface, and so this is a potential risk they’re willing to take. Tragedy of the commons that someone who hasn’t…

tbh hackerone should just implement a +/- reputation points feature on researcher profiles. Like, the researcher submits a slop report to GitHub via H1, GitHub looks at it and identifies it as slop, GitHub presses the -rep button on reaearcher profile which bans them from submitting to GitHub on H1 again and makes their rep points minus 1. Companies should be able to configure you need at least 10 rep points to recei…

I think they do that already, there are signal ratios

Re: Restructuring GitHub's bug bounty program

#19

Post by 2001zhaozhao »

fragmede wrote: post #10

[flagged]

They seem to be doing this to disincentive people who spam bug reports with AI where only 10% of them are actually real.

Instead, now you probably need to be actually vetting your bug reports yourself so that a large percentage of them are real, before they let you in the verified program, where you get a normal amount of payout.

So it incentivizes high quality AI bug spamming (if you can manage it) over low quality AI bug spamming. In turn since less people are doing low quality AI bug spamming, Github gets to spend less time filtering the low quality reports.

Post reply on HN