The Trust Center lists a gated Bug Bounty DLOE (Delivered Letter of Engagement or similar attestation) document covering April through June 2025, available only via an access request.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The availability of a bug bounty program attestation document indicates GitHub maintains a formal vulnerability disclosure and reward program for Copilot-related infrastructure, which is relevant to enterprise security assessments and software supply chain security evaluations.
Interpretive note: The acronym DLOE is not defined in the visible document text; its precise meaning and the nature of the attestation it represents cannot be confirmed from the document alone.
Removal of gated bug bounty documentation suggests consolidation of security information or change in disclosure approach for vulnerability management details.
View full change record →New disclosure of a gated bug bounty program document indicates GitHub is formally documenting and restricting access to security vulnerability disclosure policies.
View full change record →This provision discloses the existence of a GitHub bug bounty program and an associated attestation document covering April through June 2025; the document is access-gated and requires a formal request to obtain.
How other platforms handle this
We will make it clear by notice to you which (if any) goods or services, or website links, we receive a benefit from by featuring them on our Platform.
In certain situations, Glassdoor may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
prevent or detect violations of our Terms or fraud or abuse of Strava or its users; or (4) protect our operations or our property or other legal rights, including in connection with actual or potential litigation.
"GitHub.Bug.Bounty.DLOE.Apr.-.June.2025.pdf [lock icon, access-gated]Excerpt from GitHub's Copilot Business Privacy Statement
(1) REGULATORY LANDSCAPE: Bug bounty and vulnerability disclosure programs are referenced in frameworks such as NIST CSF, ISO 27001, and EU NIS2 Directive requirements for coordinated vulnerability disclosure.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The availability of a bug bounty program attestation document indicates GitHub maintains a formal vulnerability disclosure and reward program for Copilot-related infrastructure, which is relevant to enterprise security assessments and software supply chain security evaluations.
This provision discloses the existence of a GitHub bug bounty program and an associated attestation document covering April through June 2025; the document is access-gated and requires a formal request to obtain.
ConductAtlas has identified this type of provision across 273 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.