GitHub scales back bug bounties, reminds users security is their responsibility too

"“Not every valid submission represents a meaningful security risk. Some reports identify hardening opportunities or documentation gaps,” Jarom Brown, a senior security researcher at GitHub, wrote in a blog post."

"“These reports are often well-written and technically accurate in their observations, but they misunderstand where the security boundary lies. When an 'attack' requires the victim to actively seek out and engage with attacker-controlled content (cloning a malicious repo, asking an AI tool to analyze untrusted code, opening a crafted file), the security boundary is the user's decision to trust that content. These scenarios generally don't represent a bypass of GitHub's security controls,” he wrote."

"“We have no problem with researchers using AI tools. AI is a force multiplier, and we expect it to play an increasing role in security research. We use AI”"

GitHub is seeing a surge in bug bounty submissions that lack meaningful security impact, driven in part by generative AI. The program is shifting from cash bounties to swag rewards for reports with low security impact. Researchers are being asked to avoid low-quality reports and issues that are not caused by GitHub. Some submissions focus on hardening opportunities or documentation gaps rather than exploitable vulnerabilities. Other reports describe out-of-scope scenarios where an undesirable outcome occurs only after a user actively engages with attacker-controlled content, such as cloning malicious repositories, using AI tools on untrusted code, or opening crafted files. These cases generally do not bypass GitHub security controls. AI tools are welcomed as a force multiplier for security research.

Read at InfoWorld