We want to keep GitHub safe for everyone. If you've discovered a security vulnerability in GitHub, we appreciate your help in disclosing it to us in a responsible manner.

White Hat

Publicly disclosing a vulnerability can put the entire community at risk. If you've discovered a security concern, please email us at security@github.com. We'll work with you to make sure that we understand the scope of the issue, and that we fully address your concern. We consider correspondence sent to security@github.com our highest priority, and work to address any issues that arise as quickly as possible.

Please act in good faith towards our users' privacy and data during your disclosure. We won't take legal action against you or administrative action against your account if you act accordingly: White hat researchers are always appreciated.

Thanks!

Thank you for your help with keeping the GitHub community safe. We really appreciate it.

And a very special thanks to the following people that have responsibly disclosed vulnerabilities in the past (an * indicates two or more vulnerabilities were reported):

Note: While we sincerely appreciate reports for vulnerabilities of all severity levels, listing on this page is reserved for people who have reported previously unknown vulnerabilities, which GitHub has determined to be, of a high or critical severity. Or in cases where there has been continued research or other contributions made by the person.

If you have responsibly disclosed a security vulnerability in the past and would like to have your name listed here, please email support@github.com with details.