We're excited to share the newest addition to our GitHub Bug Bounty Program!
Our bug bounty team has had an exciting year, including celebrating the eighth year of our program, hosting a live hacking event in June, spotlighting one of our hackers for cybersecurity awareness month, and spending more time with our community at events such as DEFCON 30. Along the way, we have captured feedback from participants in our program, and we are very excited to announce that we are introducing our very own swag store!
The addition of the swag store comes from many conversations and feedback on how we can continue to improve our bug bounty program. We learned that not only do our researchers genuinely enjoy receiving swag but they also like to show off their involvement with our bounty program.
The new GitHub Bug Bounty swag store will allow researchers to earn exclusive bug bounty branded swag, as a bonus perk to their earned bounty reward. Through reports, researchers have the ability to receive points that can be redeemed for t-shirts, sweatshirts, stickers, and other cool items. For information about our new store, please visit our bounty store FAQ.
Our partnership with talented security researchers from across the community is pivotal in running a successful bug bounty program, so we thank all who continue to support and participate in our program. Your submissions are greatly valued and impactful to ensuring the safety and security of our products, our users, and the community, and we are excited to introduce even more incentives. For more details regarding the program’s scope, rules, and rewards please visit our website. Happy hacking!
We’ve dramatically increased 2FA adoption on GitHub as part of our responsibility to make the software ecosystem more secure. Read on to learn how we secured millions of developers and why we’re urging more organizations to join us in these efforts.
This blog post is an in-depth walkthrough on how we perform security research leveraging GitHub features, including code scanning, CodeQL, and Codespaces.
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
Jill Moné-Corallo 
