GitHub Bug Bounty团队在启动网络安全意识月时
安全研究界让GitHub更加安全，十多年来，来自世界各地的研究人员帮助我们查明和解决脆弱性，然后才能加以利用，帮助保护授权数百万个发展项目的守则。 由于GitHub Copilot和Copilot编码agent等AI动力经验重塑了软件的构建方式，与传统和新兴攻击表面的熟练研究人员合作比以往任何时候都更重要。
今年是我们方案的新篇章。 我们调整了我们的赏金桌，围绕我们激励的核心转变：你不靠提交更多，作为这一变革的一部分，我们为一贯提供高质量、高影响工作的研究人员正式制订了一个永久性的、只受邀请的VIP方案。
VIP研究人员收到：
- 大幅提高付款额——30 000美元或以上用于关键调查结果
- 缩短对划界案的答复时间
- 在公共发布前及早预览β产品和特征
VIP程序的路径基于展示，一致的质量。 有1个关键、2个高、4个中或7个低度解析结果的研究人员可能会得到邀请。 参观我国公共赏金网站了解更多资质标准。
为了庆祝今年10月的网络安全意识月，我们正关注一位在VIP计划中贡献最大的研究人员，@vaib25vicky专门从事授权和访问控制研究，他们对复杂攻击表面的深度持续关注恰恰说明了我们重组后计划旨在奖励的深思熟虑的研究
你是如何在保安和bug赏金中开始的
我从小就对电脑感兴趣。 在大学里，我做了很多编码，建造不同的项目和尝试的东西—— 只是呆子的东西。 这样做的时候，我开始深刻地理解系统，并找到方法让他们按照我想要的方式行事。 这基本上是黑客。 后来偶然发现虫子赏金，开始打猎，觉得很有趣。 后来我找到了GitHub的bug赏金程序。 我经常用GitHub做自己的作品，随着时间的推移，我比其他节目更关注GitHub，因为回报很高
你最喜欢的虫类是什么？
我并不是按虫类打猎。 当我找到一个特征，我用它，理解它是如何工作的，并想出它可能被滥用的方式来引起安全问题。 因此，我测试的bug类依赖于特性本身。
如何保持技能精锐保持新的脆弱趋势？
我关注个体研究者和公司博客的组合。 在X上，我跟随研究人员分享真正的发现和写作。 博客，我读公司的研究文章和错误的赏金写作。 我还检查过Hacker News和一些安全下潜我最喜欢的一些博客包括Google Project Zero,GitHub 安全实验室，PortSwigger和Hacker News.
带我们通过你的一般方法。 如何选择目标区域，如何从“有趣的特征”到确认的发现？
我选一个目标区域看起来复杂很难理解。 由于我的经验，我通常可以发现一个特写是否值得我的时间。 我花一些时间在它上看看有什么有趣的东西出现。 如果不是，我接着说下一个。 一旦我找到值得探索的东西，我就继续使用和探索这个功能，直到发生奇怪的事情。 根据特性，我测试不同种类的虫子沿途。
你在你的研究中使用AI吗？它的真正帮助何在，其不足何在？
是的，我用人工智能它能节省我的时间，提高我的生产力。 这就像一个伟大的助手。 其不足之处在于你仍然必须引导它。 依我看，AI就像一辆真正的快车，但它仍然需要一个好的司机。
你如何指导在错误赏金中负责任地使用AI?
我想说的是
测试它们需要不同于传统网络错误的心态吗？
你确实需要思考有点不同。 但大多数的虫子，包括高影响虫，仍然是授权问题，护栏薄弱，或者被忽略的能力。 我认为这些可以和传统网络bug一样的心态找到。
你刚开始时所希望的是什么？
这一进展需要时间。 我早就希望我知道，在寻找目标之前，耐心是工作的一部分。
你不喜欢黑客攻击
我喜欢玩游戏和旅行放松一下，我只是去一个很好的旅行。
你愿意和读者分享任何社交媒体简介吗？
我主要在X
@vaib25vicky感谢您参与GitHub的bug赏金研究员聚光灯！每一次向我们的bug赏金计划呈文，都是让GitHub，我们的产品，我们的客户更加安全的机会，我们继续欢迎和赞赏与安全研究界的合作。 所以，如果这激励你去猎杀虫，自由通过HackerOne报告你的发现。
标记：
编剧：
有关员额
如何利用我们的开源 AI安全agent发现24个Android漏洞
看看这些发现背后的目标AI任务流，他们发现的关键Androidbug，以及如何在自己的应用上运行同样的开源 agent.
AI动力模糊测试与GitHub安全实验室任务流量Agent
我解释如何使用基于GitHub安全实验室 Taskflow Agent AI框架的新模糊测试任务流量。
"OpenClaw"病毒化了 (美国英语). 见守者楼并固。
OpenClaw是GitHub历史上增长最快的项目。 Peter Steinberger和几位维护者分享他们在项目头六个月学到的知识。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
As we kick off Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to spotlight one of the top-performing security researchers participating in the GitHub Security Bug Bounty Program: @vaib25vicky!
The security research community makes GitHub safer for everyone—that’s the simple idea behind GitHub’s Bug Bounty Program. For more than a decade, researchers from around the world have helped us identify and fix vulnerabilities before they could be exploited, helping protect the code that powers millions of development projects. As AI-powered experiences such as GitHub Copilot and the Copilot coding agent reshape how software is built, partnering with skilled researchers across both traditional and emerging attack surfaces matters more than ever.
This year marked a new chapter for our program. We restructured our bounty tables around a core shift in what we incentivize: you don’t earn more by submitting more—you earn more by submitting better. As part of this change, we formalized a permanent, invite-only VIP program for researchers who consistently deliver high-quality, high-impact work.
VIP researchers receive:
- Significantly higher payouts—up to $30,000 or more for critical findings
- Faster response times on their submissions
- Early previews of beta products and features before public launch
The path to the VIP program is based on demonstrated, consistent quality. Researchers who have one critical, two high, four medium, or seven low-severity resolved findings may earn an invitation. Visit our public bounty site to learn more about the qualification criteria.
To celebrate Cybersecurity Awareness Month this October, we’re spotlighting one of the top-contributing researchers in our VIP program and exploring their methodology, techniques, and experiences researching GitHub. @vaib25vicky specializes in authorization and access control research and has uncovered some of the most nuanced and impactful issues in our ecosystem. Their deep, sustained focus on a complex attack surface exemplifies exactly the kind of thoughtful research our restructured program was designed to reward.
How did you get started in security and bug bounty, and what keeps you coming back to GitHub’s program?
I’ve been interested in computers since childhood. In college I did a lot of coding, building different projects and trying things out—just nerd stuff. While doing that, I started to understand systems deeply and found ways to make them behave the way I wanted. That was basically hacking. Then I discovered bug bounty by accident and started hunting, and I found it really fun. Later I found GitHub’s bug bounty program. I’d used GitHub a lot in my own work, so it felt natural to start there. Over time I focused on GitHub more than other programs because of the high rewards, it’s challenging, the team is great, and I’ve had a good experience.
What are your favorite classes of bugs to research and why?
I don’t really hunt by bug class. When I find a feature, I use it, understand how it works, and think of ways it could be misused to cause a security problem. So the bug classes I test for depend on the feature itself.
How do you keep your skills sharp and stay on top of new vulnerability trends?
I follow a mix of individual researchers and company blogs. On X, I keep up with researchers who share real findings and write-ups. For blogs, I read company research posts and bug bounty write-ups. I also check Hacker News and some security subreddits now and then. Some of my favorite blogs are Google Project Zero, GitHub Security Lab, PortSwigger, and Hacker News.
Walk us through your general approach. How do you pick a target area, and how do you go from “interesting feature” to a confirmed finding?
I pick a target area that looks complex and hard to understand. Thanks to my experience, I can usually spot whether a feature is worth my time. I spend some time on it to see if anything interesting comes up. If not, I move on to the next one. Once I find something worth digging into, I keep using and exploring the feature until something odd happens. Depending on the feature, I test for different types of bugs along the way.
Do you use AI in your research? Where does it genuinely help and where does it fall short?
Yes, I use AI. It saves me time and increases my productivity. It’s like a great assistant. Where it falls short is that you still have to steer it. The way I see it, AI is like a really fast car, but it still needs a good driver.
What’s your guidance on using AI responsibly in bug bounty?
The main thing I’d say is to always verify what the AI gives you and never submit a finding you haven’t confirmed yourself.
As the industry ships more AI-powered features, does testing them require a different mindset than traditional web bugs?
You do need to think a little differently. But most bugs, including the high-impact ones, are still authorization issues, weak guardrails, or overlooked capabilities. I think these can be found with the same mindset as traditional web bugs.
What’s one thing you wish you’d known when you first started?
That progress takes time. Early on I wish I’d known it’s normal to spend a long time on a target before finding anything. Patience is part of the job.
What do you enjoy doing when you aren’t hacking?
I like playing games and travelling. To relax, I just take a good trip.
Any social media profiles you’d like to share with our readers?
I’m mostly on X, handle @vaib25vicky.
Thank you, @vaib25vicky, for participating in GitHub’s bug bounty researcher spotlight! Each submission to our bug bounty program is a chance to make GitHub, our products, and our customers more secure, and we continue to welcome and appreciate collaboration with the security research community. So, if this inspired you to go hunting for bugs, feel free to report your findings through HackerOne.
Tags:
Written by
Related posts
How we found 24 Android vulnerabilities using our open source AI security agent
A look at the targeted AI taskflows behind these findings, the critical Android bugs they uncovered, and how to run the same open-source agent on your own app.
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
In this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework.
OpenClaw went viral. Meet the maintainers building and securing it.
OpenClaw is the fastest-growing project in GitHub history. Peter Steinberger and several maintainers share what they learned in the project’s first six months.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.