Ability to "bug bounty" issues and pay fixers via sponsors

[whawker]

I think a great addition to sponsors, would be the ability to attach a monetary value (or "bounty") to a GitHub issue. This could incentivise developers to address the issue, and perhaps attract new maintainers to an open source project.

In my mind, this would work via automatically paying the creator of a PR the attached bounty, when their PR is merged.

Risks:

1. Bad actors copying the code from the PR, without merging it, to avoid paying?
2. Fix PRs with commits from multiple developers - how would the bounty be fairly divided?

[porunov]

I believe this is a must have feature in GitHub 🚀

That said, I guess the obvious issue which stops GitHub from implementing this essential issue is regulatory problems. Most likely developers who are working and solving those issues won't be able to accept money with the current GitHub Sponsorship tools. Otherwise GitHub would enable Sponsorship option for residents from all over the world.
Thus, it's less of a technical issue and more of a bureaucracy / legal issue.

From technical side of this issue I also think that all the problems of unfairness or bounty split should be solved when we really see them being an issue. At the begging I would prefer to use KISS principle for this feature.
I.e. in case there is a small percentage of code thieves which doesn't bother much - so be it. This could simply be eliminated by maintainers who manually decide to whom and what percentage the bounty should go when they close the issue. I believe they could even forward all that money to the project itself if it's not obvious who solved that issue or maybe trigger refund of all donations back to backers.

Nevertheless, there could be potentially many features about sponsoring specific issues. Some projects implementing this functionality are below:

• https://bountysource.com/ (GitHub: https://github.com/bountysource/core ) - takes 10% fee from the person who withdraws money.
• https://issuehunt.io/ (GitHub: https://github.com/IssueHunt/readme ) - takes 10% fee from the donated amount.
• https://gitpay.me/ (GitHub: https://github.com/worknenjoy/gitpay ) - either 8% or 16% fee (8% + 8%).

Also, there is a list of other bounty projects here: https://github.com/fossjobs/fossjobs/wiki/resources#bounties

P.S. This problem is definitely worth implementing as this is an obvious "pain" for many users. I would be more than happy to donate money to some issues, but currently there is no an easy way of doing so 🥲

P.P.S. I'm also thinking this could be solved slightly differently from the legal / bureaucracy perspective. Probably far from ideal, but it could work for many cases quite nicely.
Let people simply donate money directly to the project, but adding a reference to a specific GitHub issue, so that owners know that the backer prefers this money to be transferred to the one who implements that issue.
After the issue is closed maintainers could contact the person who implemented for that issue and transfer money using any available methods they have. If there are no good ways of transferring money to the person who implemented for that issue (or the person doesn't want that money) then maintainers could say "thank you" and direct those monies towards the project development.
This would effectively eliminate all the possible bureaucracy / legal issues for GitHub and allow to boost popularity for some issues.

[birkjernstrom]

Amazing thread – thanks for starting it @whawker!

We're building Polar to give maintainers complementary tools for better funding and add-on services. Our first feature now is the ability to get funding towards specific issues/features (and soon milestones too). It's built for maintainers vs. bounty hunters, and built as a GitHub App to integrate beautifully in context of the issues you want to support funding towards. It embeds a badge at the bottom of the issues body/description.

Polar is also open source (Apache 2.0): https://github.com/polarsource/polar

Example of the Polar badge embedded on an issue at the bottom:
polarsource/polar#897

[pktiuk]

Polar seems to be the best solution out there (at least for now).
Really great job you are doing out there.

But it still lacks on some functionalities like a way of discovering projects using it.

[HDVinnie]

Polar is 100% way better then GitHub. Tools wise. Just know there are fees unlike GitHub which is fair but should be known.

[birkjernstrom]

Thank you both for the kind words :)

@pktiuk What would you use discovery for? Is it to find all issues with funding & rewards as a potential contributor?

[pktiuk]

@birkjernstrom
To be honest, I was just curious how many and how big projects already use Polar (you already show some of them on as Highlighted Creators). Maybe some of these projects are the ones I already starred. You should at least add page listing projects using polar among projects I already starred (because I should be interested in them by definition).

But in general it could be used by freelancers willing to earn some money.
If I would be a freelancer I would like to have some way of filtering projects with rewards. (or maybe filtering issues with rewards).

[ThioJoe]

I was thinking of something like this except for feature requests. Like there might be a feature many users are requesting, but it might be particularly time consuming or difficult to implement, so someone could effectively "sponsor" a feature request to give the developer an incentive to implement it sooner.

Makes me think of the countless times I've seen features in programs being requested for years.

[OfficialCRUGG]

That's exactly what this feature request is about though?!

[estahn]

I think one angle that is rarely talked about is developers at companies can sponsor creators through the company org account. In that same regard developers should be able to put a bounty on issues through the company org. Companies would be able to budget for these expenses, get invoiced via the regular invoice system thus giving developers at a company more freedom by reducing the bureaucracy one has to go through if they want to sponsor projects/issues.

This may require some adjustments to the permission system since you may only want your technical leads/managers etc make those calls.

[bdresser]

Hey @whawker, this is a great idea and something we've been thinking about. I have a couple questions around how you'd expect this to work, if you don't mind!

the ability to attach a monetary value (or "bounty") to a GitHub issue.

Would you imagine anyone could attach a bounty to an issue, or only the project owner?

automatically paying the creator of a PR the attached bounty, when their PR is merged

How would you want to verify that the attached PR fixes the issue? Would you expect the project owner or bounty poster has to "accept" the PR as something that works as promised?

[whawker]

Would you imagine anyone could attach a bounty to an issue, or only the project owner?

I guess in a similar vein to StackOverflow, anyone could attach a bounty to an issue.

How would you want to verify that the attached PR fixes the issue

I guess this would have to be a manual approval step by the bounty poster. I suppose bad actors comes into again though, saying the PR doesn't fix the issue, when in reality it does, to avoid actually having to pay.

Further thoughts on deterring bad actors:

• Perhaps PRs against a bountied issue have the code hidden, to prevent someone else from creating a duplicate PR and stealing the bounty.
• Maybe a PayPal style payment system could be used, where the money is held by GitHub as in intermediary.
  • I.e. When a bounty is created the money is transferred immediately and held by GitHub.
  • Then when the issue is confirmed as fixed by the bounty creator, the money is transferred from GitHub to the fix creator(s).
• In terms of how to divide the bounty, if multiple developers have contributed to a single PR, may the PR creator could define the percentage split when they create the PR?

[Malvoz]

Would you imagine anyone could attach a bounty to an issue, or only the project owner?

I guess in a similar vein to StackOverflow, anyone could attach a bounty to an issue.

Supposedly project owners/maintainers would have to accept the bounty as well. Otherwise someone could, for example, attach a huge bounty on a feature which the project does not need or explicitly does not want.

[pktiuk]

Maybe it would be good to check how it works in https://bountysource.com/ ?

[HDVinnie]

Bump

[unitycoder]

i'd like to use this for regular issues (not bug bounty related),
just any regular issue / feature that i could offer bounty for.