🤖robot.villas
PostsTagsStatsStatusAbout

© 2025 - 2026 Nat Welch. All rights reserved.

← All bots

GitHub Bug Bounty

@github_bug_bounty@robot.villas

Archived GitHub bug bounty disclosures and researcher acknowledgements, with feed entries through 2019.

Source: https://bounty.github.com/feed.atom

Homepage: https://bounty.github.com

Follow from your server

Enter the server your account is on. You'll finish following there.

or
Or search your app for@github_bug_bounty@robot.villas

Don't have an account? Find a server at joinmastodon.org

Posts
100
Followers
0
Following
0

Posts

  • GitHub Actions secret leak #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22407993

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22407993

    Don't have an account? Find a server at joinmastodon.org

    Sep 29, 2019

  • Repository imports defaulting to public regardless of user's visibility selection #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408001

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408001

    Don't have an account? Find a server at joinmastodon.org

    Apr 22, 2019

  • Incorrect OAuth scopes shown on authorization page #Security #BugBounty #OAuth

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408011

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408011

    Don't have an account? Find a server at joinmastodon.org

    Mar 20, 2019

  • Missing authentication on GitHub Enterprise QA deployments #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408021

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408021

    Don't have an account? Find a server at joinmastodon.org

    Oct 20, 2018

  • Argument injection when cloning Git submodules #Security #BugBounty #Git

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408032

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408032

    Don't have an account? Find a server at joinmastodon.org

    Sep 23, 2018

  • Creating verified commits for arbitrary emails using web commits #Security #OpenSource #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408043

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408043

    Don't have an account? Find a server at joinmastodon.org

    Jun 29, 2018

  • "Require review from Code Owners" bypass using unverified email addresses #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408052

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408052

    Don't have an account? Find a server at joinmastodon.org

    Jun 9, 2018

  • Secret Gist disclosure with scopeless OAuth token #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408061

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408061

    Don't have an account? Find a server at joinmastodon.org

    May 23, 2018

  • Bypass OAuth access policy on GraphQL API #Security #BugBounty #GraphQL

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408070

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408070

    Don't have an account? Find a server at joinmastodon.org

    May 13, 2018

  • RCE in GitHub Pages when building with submodules #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408079

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408079

    Don't have an account? Find a server at joinmastodon.org

    Apr 29, 2018

  • CSRF in opting out of organization invites #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408087

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408087

    Don't have an account? Find a server at joinmastodon.org

    Feb 14, 2018

  • XSS on render.githubusercontent.com through filename in ipynb #Security #BugBounty #XSS

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408096

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408096

    Don't have an account? Find a server at joinmastodon.org

    Feb 2, 2018

  • Extending the scopes of an SSO-authorized personal access token without a SAML session #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408105

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408105

    Don't have an account? Find a server at joinmastodon.org

    Jan 10, 2018

  • Localhost same-site request forgery via GitHub Webhooks #Security #BugBounty #WebSecurity

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408113

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408113

    Don't have an account? Find a server at joinmastodon.org

    Dec 21, 2017

  • Insufficient authorization check when previewing non-code files #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408121

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408121

    Don't have an account? Find a server at joinmastodon.org

    Nov 27, 2017

  • Insufficient token scope checks for Gist access via Git #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408129

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408129

    Don't have an account? Find a server at joinmastodon.org

    Nov 16, 2017

  • Repository administrator privilege escalation via GitHub App installation #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408138

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408138

    Don't have an account? Find a server at joinmastodon.org

    Nov 11, 2017

  • Claiming an organization invite without proving ownership of the invited email address #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408145

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408145

    Don't have an account? Find a server at joinmastodon.org

    Nov 8, 2017

  • Repository administrators can bypass repository visibility permissions #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408155

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408155

    Don't have an account? Find a server at joinmastodon.org

    Nov 6, 2017

  • Insufficient authorization check when adding issues to projects #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408163

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408163

    Don't have an account? Find a server at joinmastodon.org

    Nov 3, 2017

  • Insufficient authorization check of GitHub App repo creation #Security #GitHub #Bounty

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408171

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408171

    Don't have an account? Find a server at joinmastodon.org

    Sep 27, 2017

  • Bypass organization paid plan billing validation #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408180

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408180

    Don't have an account? Find a server at joinmastodon.org

    Sep 1, 2017

  • Private issue title disclosure via marking as duplicate #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408188

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408188

    Don't have an account? Find a server at joinmastodon.org

    Jul 18, 2017

  • Repository Service Hooks making non-http requests #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408198

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408198

    Don't have an account? Find a server at joinmastodon.org

    Jul 13, 2017

  • GitHub employee GitHub.com tokens exposed via NPM package #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408210

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408210

    Don't have an account? Find a server at joinmastodon.org

    Jul 6, 2017

  • NPM token for Electron exposed #Security #BugBounty #NPM

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408220

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408220

    Don't have an account? Find a server at joinmastodon.org

    Jul 4, 2017

  • XSS in commit messages #Security #BugBounty #XSS

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408230

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408230

    Don't have an account? Find a server at joinmastodon.org

    Jul 2, 2017

  • GitHub Enterprise pre-receive hooks access sensitive localhost services #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408241

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408241

    Don't have an account? Find a server at joinmastodon.org

    Jun 17, 2017

  • GitHub Desktop remote code execution #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408248

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408248

    Don't have an account? Find a server at joinmastodon.org

    May 21, 2017

  • GIT LFS code execution #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408258

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408258

    Don't have an account? Find a server at joinmastodon.org

    May 12, 2017

  • Unintended services exposed to internet due to ACL changes #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408268

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408268

    Don't have an account? Find a server at joinmastodon.org

    Mar 22, 2017

  • User-controlled `class` attribute on some Markdown tags #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408277

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408277

    Don't have an account? Find a server at joinmastodon.org

    Mar 21, 2017

  • Cross-origin brute-forcing of SAML and 2FA recovery codes #Security #BugBounty #Privacy

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408286

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408286

    Don't have an account? Find a server at joinmastodon.org

    Mar 16, 2017

  • Organization member can change organization visibility for other members #Security #BugBounty #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408296

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408296

    Don't have an account? Find a server at joinmastodon.org

    Mar 1, 2017

  • SAML Response attribute not revoked to prevent replay attacks #Security #BugBounty #SAML

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408305

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408305

    Don't have an account? Find a server at joinmastodon.org

    Feb 28, 2017

  • Unauthenticated organization SAML recovery code download #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408314

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408314

    Don't have an account? Find a server at joinmastodon.org

    Feb 22, 2017

  • List repositories API returns incorrectly cached response #BugBounty #GitHub #Security

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408327

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408327

    Don't have an account? Find a server at joinmastodon.org

    Feb 11, 2017

  • HTTP header injection in Git proxy #Security #BugBounty #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408337

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408337

    Don't have an account? Find a server at joinmastodon.org

    Feb 1, 2017

  • GitHub Enterprise management console remote code execution #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408348

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408348

    Don't have an account? Find a server at joinmastodon.org

    Jan 26, 2017

  • GitHub Enterprise remote code execution via SSRF #Security #BugBounty #Vulnerability

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408359

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/github_bug_bounty/posts/22408359

    Don't have an account? Find a server at joinmastodon.org

    Jan 23, 2017
Older »