GitHub宣布对其漏洞赏金计划进行重组，采取多项改革措施以提升报告质量1。
新政策引入永久VIP项目，以表彰高质量的安全研究人员1。符合VIP资格的条件包括至少一个关键发现、或两个高级发现、或四个中级发现、或七个低级发现1。
赏金支付结构也将随之调整，从原有的金额区间制改为固定金额1。此外，GitHub实施HackerOne信号要求，未达阈值的研究人员最多可提交4份初始报告，旨在减少低质量和AI生成的报告1。
新政策自2026年7月27日起生效1。在此日期之前提交的报告将继续按原有赏金结构处理1。
GitHub has announced a comprehensive restructuring of its bug bounty program, introducing a permanent VIP tier to recognize top-performing researchers while implementing stricter quality controls. 1
The revamped program establishes a new VIP classification with specific eligibility thresholds: researchers must have identified at least one critical vulnerability, or two high-severity findings, or four medium-severity findings, or seven low-severity findings to qualify. 1
Under the revised compensation structure, bounty amounts will be fixed figures rather than ranges. 1 Additionally, GitHub is implementing HackerOne signal requirements to filter out low-quality and AI-generated submissions; researchers who have not yet met the necessary threshold may submit up to four initial reports. 1
The new policy takes effect on July 27, 2026. 1 Reports submitted prior to this date will continue to be processed under the previous bounty structure. 1
评论
还没有评论，欢迎留下第一条。