Submitting High-Quality Bug Bounty Reports on GitHub: A Comprehensive Guide

Overview

Security researchers are vital to GitHub’s mission of protecting over 180 million developers. The GitHub Bug Bounty Program has long relied on external expertise to uncover vulnerabilities, and that collaboration remains a cornerstone of their security strategy. However, the landscape of bug bounty submissions has changed dramatically. With the rise of AI tools and automated scanners, the volume of reports has surged—and along with it, low-quality submissions that lack real security impact. GitHub refuses to shut down its program like some others have. Instead, they are raising the bar on what constitutes a complete, valuable report. This guide walks you through the new expectations, from preparation to submission, so you can contribute meaningfully and maintain a strong Signal score on HackerOne.

Submitting High-Quality Bug Bounty Reports on GitHub: A Comprehensive Guide — Source: github.blog

Prerequisites

Before diving into the submission process, ensure you have the following:

Basic understanding of web security – Familiarity with common vulnerabilities (XSS, CSRF, SSRF, authentication bypass, etc.) and exploitation techniques.
Access to a HackerOne account – All reports go through HackerOne; your reputation there matters.
Knowledge of GitHub’s scope and ineligible list – Read the official program page thoroughly.
Testing environment – For building and validating proof of concept (PoC) exploits. This can be a local setup or a dedicated lab instance.
Tool stack – You may use scanners, static analyzers, AI assistants, or manual techniques. All are welcome, but validation is key.

Step-by-Step Instructions

1. Understand Scope and Ineligible Findings

Before you even start hunting, review GitHub’s published scope and the list of ineligible findings. Common categories that are automatically closed as “Not Applicable” include:

DMARC / SPF / DKIM configuration issues
User enumeration via timing or error messages
Missing security headers without a demonstrated attack path
Content spoofing without actual traffic interception

Why this matters: Submitting a report that falls under these categories will not only be dismissed quickly, but it may also damage your HackerOne Signal and reputation. Take five minutes to cross-check your finding against the ineligible list before writing anything.

2. Develop a Working Proof of Concept (PoC)

A theoretical description is no longer enough. You must demonstrate concrete security impact. Ask yourself: “What can an attacker actually achieve?” Your PoC should show the exact steps to cross a security boundary and the real consequence (e.g., data exfiltration, privilege escalation, code execution).

Example: If you discover an XSS vulnerability, don’t just say “This could allow script injection.” Provide a payload that executes in the victim’s browser, and explain what an attacker could steal (cookies, tokens, etc.). Use a simple HTML page with a crafted request that triggers the XSS and logs the captured data to a server you control.

For a more complex attack (e.g., server-side request forgery), show the request, the response, and the internal resource accessed. If possible, include screenshots or network logs as part of your report.

3. Validate Your Findings Before Submission

Regardless of the tools you use—scanners, static analysis, or an AI assistant—you must manually validate every finding. A tool might flag a false positive that looks plausible at first glance but falls apart under scrutiny. Validate by:

Repeating the attack manually
Confirming the exploited endpoint is within scope
Verifying that the impact is real (e.g., not rate-limited or filtered in production)
Checking if the issue is already known or patched

AI-specific note: GitHub explicitly welcomes AI use in research, but they expect you to review AI-generated outputs. Never copy-paste a raw AI suggestion without testing it. An AI may hallucinate attack vectors or produce invalid payloads. Validate diligently.

4. Write a Clear and Complete Report

A good report helps triagers understand the issue quickly and reduces back-and-forth. Structure your submission as follows:

Title – Short and descriptive (e.g., “Stored XSS in pull request comment field”).
Summary – Two to three sentences explaining the vulnerability and its impact.
Steps to Reproduce – Numbered list of exact steps, including any prerequisite conditions (e.g., “Logged in as user X with repo admin role”).
Proof of Concept – Attach or embed your working PoC (code, screenshots, video).
Impact – Describe what a real attacker could do (e.g., “An attacker can exfiltrate private repo metadata”).
Tools Used – List any tools or AI assistants you used (optional but helpful).

5. Submit via HackerOne

Navigate to GitHub’s program on HackerOne and click “Submit Report.” Fill in the fields accordingly. Ensure you attach all files (PoC scripts, screenshots) directly. Do not link to external sites for PoCs, as they may go down. Use HackerOne’s file upload.

After submission, monitor the report. Triage times may vary. Be prepared to answer clarifying questions or provide additional evidence. Polite and prompt communication improves your reputation.

6. Respond to Feedback and Iterate

If the triager closes your report as “Not Applicable” or “Invalid”, read their comments carefully. They may point out gaps in your PoC or scope issues. Learn from that feedback for future submissions. Sometimes a report can be rewritten and resubmitted if it truly has impact but was poorly presented. However, avoid resubmitting the same finding repeatedly unless you have new evidence.

Common Mistakes

Submitting without a PoC – This is the most frequent reason for rejection. A description like “This could lead to RCE” without a working exploit is noise.
Ignoring the ineligible list – Many researchers waste time on missing security headers or email config issues that GitHub explicitly excludes. This damages your Signal.
Relying solely on AI without validation – AI tools can generate plausible-sounding vulnerabilities that are false positives or already known. Always test manually.
Submitting theoretical attack chains – “If X then Y then Z” without proving step one is insufficient. The chain must be demonstrated end-to-end.
Using automated scanners without review – Scanners produce large volumes of low-quality findings. Manually triage before submitting. One high-quality report beats ten that are noise.

Summary

GitHub is committed to its bug bounty program but is raising expectations for submission quality. To succeed, researchers must provide a working PoC with demonstrated impact, understand the program’s scope, and validate findings manually—even when using AI tools. By following this guide, you can submit reports that stand out, protect your HackerOne reputation, and continue to help make GitHub safer for millions of developers.

Tags: