Microsoft-owned code hosting platform GitHub has paid out more than $4 million through its bug bounty program, which the company launched 10 years ago.
GitHub’s bug bounty program passed the $4 million milestone in 2023, when it also paid out the highest single reward to date, $75,000.
The amount was awarded for a vulnerability that allowed access to the environment variables of a production container. The discovery of the flaw prompted GitHub to rotate credentials.
In 2023, the total payout amount exceeded $850,000. It’s worth noting that GitHub’s annual payout has exceeded $800,000 since 2021.
In addition to rewarding regular vulnerability reports, the company also ran several private bounty engagements last year with members of its VIP program.
“In the coming year, we are looking to improve our processes around payout on validation, work towards the next phase of public disclosures, continue to bring more consistency around private bounties for our community, and offer exclusive training and opportunities for our VIP community,” GitHub said.
Major companies regularly make public the results of their bug bounty programs. Netflix announced recently that it paid out over $1 million since 2016.
Zoom has paid out $10 million since 2019, and Google paid out roughly $10 million in 2023 alone, which brought the internet giant’s total since 2010 to nearly $60 million.
Related: Mozilla Launches 0Din Gen-AI Bug Bounty Program
Related: Adobe Adds Content Credentials and Firefly to Bug Bounty Program
Related: Microsoft Paid Out $63 Million Since Launch of First Bug Bounty Program 10 Years Ago
