Skip to main content

Bug bounties

Introduction​

Any ticket opened on the JHipster bug tracker can have a "$$ bug-bounty $$" label: the person who solves that ticket will get the money, either $100, $200, $300 or $500 depending on the ticket!

Who can create bug bounties?​

How much is a bug bounty?​

Next to the "$$ bug-bounty $$" label, there should be a "$100", "$200", "$300" or "$500" label, that tells how the much the bug bounty is worth.

How bug bounties are created​

Once a ticket is created, it can get the bug bounty label by two actions:

  • a silver or gold sponsor adds a comment asking to add the bug bounty label and mentioning one of the project leads on GitHub.
  • project leads and governing body directly add the bug bounty label, as they believe it is an important new feature, a critical bug, a long-standing issue, or a time-consuming task. If you are working on an issue and if you think it deserves a bounty don't hesitate to ask one of the project leads.

To be valid, the bug bounty should then have the $$ bug-bounty $$ label added by either project leads or governing body. It should also have a "$100", "$200", "$300" or "$500" label to tell how much it is worth, but if that tag has been forgotten, it is by default worth "$100".

Who can claim a bug bounty?​

A bug bounty goes to the person who fixed the issue: someone who chose to work on it, can explain the change, and answers for it in review. Using an AI assistant as a tool is fine - the work is yours and you stand behind it.

Automated accounts are not eligible. A pull request opened by a bot, or by an agent acting on its own, never earns a bug bounty, and neither does a comment claiming an issue on their behalf.

How to get the money​

Once a bug bounty is created, anybody can propose a fix (even the project leads and governing body!). Our goal is to spend that money so that something is fixed as quickly as possible.

In order to claim the money, you must:

  • Create a pull request that fixes a ticket with the "$$ bug-bounty $$" label.
  • In order to close the ticket automatically, you must have one commit message with the Fix keyword. For example, Fix #1234 to close ticket #1234.
  • That pull request must be merged by someone from the core team. If there are several pull requests, the core team member either selects the most recent one or the best one - that's up to the team member to decide what is best for the project.
  • A member of the core team must then confirm on that pull request that it is eligible for the bug bounty. This is how we check that the work comes from a person rather than from an automated account; without that comment, the expense is not validated.
  • You can then add a $100, $200, $300 or $500 expense on the JHipster OpenCollective. You must add a link to your pull request in the description (for example: $100 bug bounty claim for https://github.com/jhipster/generator-jhipster/pull/1234).
  • Then, you must add a comment on your pull request, telling that you claimed the money, with a link to your OpenCollective expense. This is to be sure it is the same person who fixed the issue and claimed the money.
  • That expense will then be validated by the project leads or governing body, who check the confirmation on the pull request, and you will receive your money on your Paypal account.