Having disclosed this back in January and it not getting fixed is really depressing.
@Cozmo23@A_dmg04
I usually wouldn't post vulnerability reporting that was done previously on twitter, but am not sure what it will take to get this actioned.
Finally got around to doing a write-up: Breaking GitHub Private Pages for $35k
This was my first and biggest bounty. Found with @ginkoid on @Hacker0x01 :) #togetherwehitharder
https://t.co/Vozjq1ZH6s
Since it's 2021 I'd like to go ahead and disclose some bugs I wasn't able to talk about in 2020. These were issues that either got NDA'd or had long remediation timelines.
The following are quick summaries and proof of concepts for some of the simpler bugs:
@A_dmg04 I've played around 8 teams of hackers this weekend, what's wrong? How can I help make this better? I feel stressed playing this game. I am no longer having fun. If there is anything I can do to make banning them easier for you (apart from the current tools) let us knw.