|
1 | | -# GitHub Security Policy |
| 1 | +Thanks for helping make GitHub safe for everyone. |
2 | 2 |
|
3 | | -GitHub's [Bug Bounty program](https://bounty.github.com) rewards researchers for discovering security vulnerabilities in a number of repositories. The full list of projects that are eligible for rewards are [available on our Bug Bounty site](https://bounty.github.com/#scope). |
| 3 | +## Security |
4 | 4 |
|
5 | | -If the repository is eligible for rewards, you can submit a report via [HackerOne](https://hackerone.com/github). You can find more useful information in our [rules](https://bounty.github.com/#rules) and [FAQ](https://bounty.github.com/#faqs). |
| 5 | +GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub). |
6 | 6 |
|
7 | | -For repositories not covered by the Bug Bounty program, please open an issue. |
| 7 | +Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation. |
| 8 | + |
| 9 | +## Reporting Security Issues |
| 10 | + |
| 11 | +If you believe you have found a security vulnerability in any GitHub-owned repository, please report it to us through coordinated disclosure. |
| 12 | + |
| 13 | +**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.** |
| 14 | + |
| 15 | +Instead, please send an email to opensource-security@github.com. |
| 16 | + |
| 17 | +Please include as much of the information listed below as you can to help us better understand and resolve the issue: |
| 18 | + |
| 19 | + * The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) |
| 20 | + * Full paths of source file(s) related to the manifestation of the issue |
| 21 | + * The location of the affected source code (tag/branch/commit or direct URL) |
| 22 | + * Any special configuration required to reproduce the issue |
| 23 | + * Step-by-step instructions to reproduce the issue |
| 24 | + * Proof-of-concept or exploit code (if possible) |
| 25 | + * Impact of the issue, including how an attacker might exploit the issue |
| 26 | + |
| 27 | +This information will help us triage your report more quickly. |
| 28 | + |
| 29 | +## Policy |
| 30 | + |
| 31 | +See [GitHub's Safe Harbor Policy](https://docs.github.com/en/github/site-policy/github-bug-bounty-program-legal-safe-harbor#1-safe-harbor-terms) |
0 commit comments