Proposal: Bug bounties on gitea? #6710

New Issue

GiteaMirror · 2025-11-02T07:04:25-06:00

GiteaMirror commented

2025-11-02 07:04:25 -06:00

Originally created by @Kreyren on GitHub (Jan 18, 2021).

Proposing to implement handling to allow anyone to submit a bug bounty on gitea issues that they care about to influence it's priority and handling in case the issue:

affects small user base (low priority issues in general)
is not economical for (F)LOSS development as it's too complicated e.g. https://github.com/QubesOS/qubes-issues/issues/4318
is for Libre Open Source Software (LOSS) project that depends on business plan in place which bug bounties would allow for.

Originally created by @Kreyren on GitHub (Jan 18, 2021). Proposing to implement handling to allow anyone to submit a bug bounty on gitea issues that they care about to influence it's priority and handling in case the issue: 1. affects small user base (low priority issues in general) 2. is not economical for (F)LOSS development as it's too complicated e.g. https://github.com/QubesOS/qubes-issues/issues/4318 3. is for Libre Open Source Software (LOSS) project that depends on business plan in place which bug bounties would allow for.

GiteaMirror closed this issue

2025-11-02 07:04:25 -06:00

GiteaMirror commented

2025-11-02 07:04:25 -06:00

@noerw commented on GitHub (Jan 18, 2021):

To clarify: with "on gitea issues" do you mean Gitea the project, or Gitea the software?

For the first, we could just put a notice for that in the issue template (& readme). But I'd make sure the wording clearly conveys that a bounty doesn't buy you that feature, but is an incentive only.

@noerw commented on GitHub (Jan 18, 2021): To clarify: with "on gitea issues" do you mean Gitea the project, or Gitea the software? For the first, we could just put a notice for that in the issue template (& readme). But I'd make sure the wording clearly conveys that a bounty doesn't buy you that feature, but is an incentive only.

GiteaMirror commented

2025-11-02 07:04:26 -06:00

@Kreyren commented on GitHub (Jan 18, 2021):

To clarify: with "on gitea issues" do you mean Gitea the project, or Gitea the software? @noerw

Gitea the software as i would like to use this for my projects. (i am mainly a LOSS developer)

@Kreyren commented on GitHub (Jan 18, 2021): > To clarify: with "on gitea issues" do you mean Gitea the project, or Gitea the software? @noerw Gitea the software as i would like to use this for my projects. (i am mainly a LOSS developer)

GiteaMirror commented

2025-11-02 07:04:26 -06:00

@techknowlogick commented on GitHub (Jan 18, 2021):

Closing this ticket as bounties for the Gitea project are a thing already (please see the link in README, https://www.bountysource.com/teams/gitea). Last week there were two large ones made. As well, commissioning developers directly is also possible.

@techknowlogick commented on GitHub (Jan 18, 2021): Closing this ticket as bounties for the Gitea project are a thing already (please see the link in README, https://www.bountysource.com/teams/gitea). Last week there were two large ones made. As well, commissioning developers directly is also possible.

GiteaMirror commented

2025-11-02 07:04:26 -06:00

@noerw commented on GitHub (Jan 18, 2021):

As @Kreyren clarified, this is about technically integrating bug bounty programs with gitea's issue tracker, not about bounties on issues of the gitea project.

@noerw commented on GitHub (Jan 18, 2021): As @Kreyren clarified, this is about technically integrating bug bounty programs with gitea's issue tracker, not about bounties on issues of the gitea project.

GiteaMirror commented

2025-11-02 07:04:26 -06:00

@techknowlogick commented on GitHub (Jan 18, 2021):

I think then this would be in scope for the bounty projects of potentially using oauth to edit tickets to insert a link into the ticket, and labelling issues appropriately. If this is a request for the bounty logic to be put directly into Gitea I think that is out of scope as dealing with being a bank and storing funds is significant undertaking.

@techknowlogick commented on GitHub (Jan 18, 2021): I think then this would be in scope for the bounty projects of potentially using oauth to edit tickets to insert a link into the ticket, and labelling issues appropriately. If this is a request for the bounty logic to be put directly into Gitea I think that is out of scope as dealing with being a bank and storing funds is significant undertaking.

GiteaMirror commented

2025-11-02 07:04:26 -06:00

@Kreyren commented on GitHub (Jan 18, 2021):

I think then this would be in scope for the bounty projects of potentially using oauth to edit tickets to insert a link into the ticket, and labelling issues appropriately. If this is a request for the bounty logic to be put directly into Gitea I think that is out of scope as dealing with being a bank and storing funds is significant undertaking.

We dont have to deal with a bank if it was using cryptocurrency e.g. monero which would allow handling the funds through the instance quite nicely. (Majority of bug bounties are using cryptocurrencies already in my experience)

Edit: also would like something that is integrated directly in the UI and set as optional configuration per repo as changing the issue content makes the issue less readable

@Kreyren commented on GitHub (Jan 18, 2021): > I think then this would be in scope for the bounty projects of potentially using oauth to edit tickets to insert a link into the ticket, and labelling issues appropriately. If this is a request for the bounty logic to be put directly into Gitea I think that is out of scope as dealing with being a bank and storing funds is significant undertaking. We dont have to deal with a bank if it was using cryptocurrency e.g. monero which would allow handling the funds through the instance quite nicely. (Majority of bug bounties are using cryptocurrencies already in my experience) Edit: also would like something that is integrated directly in the UI and set as optional configuration per repo as changing the issue content makes the issue less readable

GiteaMirror commented

2025-11-02 07:04:27 -06:00

@6543 commented on GitHub (Jan 18, 2021):

I think this is outside of gitea's scope too .. but would be a nice smal project ...

something like a "gitea bounty bot" ... since it also has to connect to cryptocurrency nodes + manage wallets, ...

@6543 commented on GitHub (Jan 18, 2021): I think this is outside of gitea's scope too .. but would be a nice smal project ... something like a **"gitea bounty bot"** ... since it also has to connect to cryptocurrency nodes + manage wallets, ...

GiteaMirror referenced this issue

2025-11-02 08:33:19 -06:00

Commits Showing Author By Full Name Not Username #9252

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6710