Six years of the GitHub Security Bug Bounty program

GitHub’s 2019 Security Bug Bounty recap: the program surpassed $1M in payouts and accelerated response to submissions. Notable findings included an OAuth authorization bypass using cross-site HEAD requests and a Mercurial-import command injection that could lead to RCE; both were patched quickly with no evidence of exploitation. The post also describes scope expansion (Actions, Dependabot, mobile, LGTM), live-hacking events and private bounties, the Security Lab bounty program, and plans to assign CVEs for Enterprise Server issues.