gosh-sh · charlieseay · Jul 30, 2026
diff --git a/docs/bug-bounty-github-linking.md b/docs/bug-bounty-github-linking.md
@@ -0,0 +1,166 @@
+# Linking GitHub Bug Reports to Bug Bounty Program
+
+## Overview
+
+This document describes the process for linking historical GitHub bug reports to user accounts in the Dex.Do Bug Bounty program.
+
+## Background
+
+During Season 1, several users reported bugs via GitHub issues with detailed reproduction steps. These reports were confirmed by the team but were not automatically linked to the Bug Bounty system since it was implemented later.
+
+## Solution
+
+We've implemented a manual verification process to credit historical bug reports:
+
+### For Users
+
+1. **Submit a Linking Request**
+   - Email: bounty@dex.do
+   - Subject: "Link GitHub Bug Reports - [Your Dex.Do Username]"
+   - Include:
+     - Your Dex.Do account email/username
+     - List of GitHub issue URLs you reported
+     - GitHub username used for reports
+
+2. **Verification Process**
+   - Team reviews GitHub issues to confirm:
+     - Issue was reported by the claimed GitHub account
+     - Issue contained detailed reproduction steps
+     - Issue was confirmed/discussed by team
+     - Issue was filed during Season 1
+
+3. **Credit Assignment**
+   - Verified reports are manually added to your Bug Bounty account
+   - You'll receive an email confirmation with updated stats
+   - Credits appear on your Bug Bounty dashboard within 48 hours
+
+### Eligibility Criteria
+
+- Report must have been filed as a GitHub issue
+- Must include detailed reproduction steps
+- Must have been acknowledged/confirmed by team
+- Must have been filed during Season 1 period
+- GitHub account must be verifiably linked to Dex.Do account
+
+### Timeline
+
+- Requests processed within 5 business days
+- Bulk backfill for known reporters: Completed by end of month
+
+## Technical Implementation
+
+For internal team reference:
+
+### Database Schema Addition
+
+```sql
+-- New table to track GitHub issue links
+CREATE TABLE bug_bounty_github_links (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES users(id),
+  github_issue_url TEXT NOT NULL,
+  github_username TEXT NOT NULL,
+  verified_at TIMESTAMP NOT NULL DEFAULT NOW(),
+  verified_by TEXT NOT NULL,
+  severity TEXT NOT NULL,
+  points_awarded INTEGER NOT NULL,
+  notes TEXT,
+  UNIQUE(github_issue_url)
+);
+
+CREATE INDEX idx_github_links_user ON bug_bounty_github_links(user_id);
+CREATE INDEX idx_github_links_verified ON bug_bounty_github_links(verified_at);
+```
+
+### Admin Script
+
+```bash
+#!/bin/bash
+# scripts/link-github-bug-report.sh
+# Usage: ./link-github-bug-report.sh <user_email> <github_issue_url> <severity> <points>
+
+USER_EMAIL="$1"
+GITHUB_URL="$2"
+SEVERITY="$3"
+POINTS="$4"
+VERIFIED_BY="${5:-admin}"
+
+if [ -z "$USER_EMAIL" ] || [ -z "$GITHUB_URL" ] || [ -z "$SEVERITY" ] || [ -z "$POINTS" ]; then
+  echo "Usage: $0 <user_email> <github_issue_url> <severity> <points> [verified_by]"
+  echo "Example: $0 user@example.com https://github.com/org/repo/issues/123 medium 50"
+  exit 1
+fi
+
+psql $DATABASE_URL <<SQL
+WITH user_lookup AS (
+  SELECT id FROM users WHERE email = '$USER_EMAIL'
+),
+github_link AS (
+  INSERT INTO bug_bounty_github_links (user_id, github_issue_url, github_username, severity, points_awarded, verified_by)
+  SELECT 
+    user_lookup.id,
+    '$GITHUB_URL',
+    (regexp_match('$GITHUB_URL', 'github\.com/([^/]+)/([^/]+)/issues/(\d+)'))[1],
+    '$SEVERITY',
+    $POINTS,
+    '$VERIFIED_BY'
+  FROM user_lookup
+  ON CONFLICT (github_issue_url) DO NOTHING
+  RETURNING user_id, points_awarded
+)
+UPDATE users
+SET bug_bounty_points = bug_bounty_points + github_link.points_awarded,
+    bug_bounty_reports = bug_bounty_reports + 1
+FROM github_link
+WHERE users.id = github_link.user_id;
+SQL
+
+echo "✓ Linked GitHub issue to $USER_EMAIL (+$POINTS points)"
+```
+
+### Bulk Import Script
+
+```bash
+#!/bin/bash
+# scripts/bulk-import-github-reports.sh
+# Reads from CSV: user_email,github_url,severity,points
+
+CSV_FILE="$1"
+
+if [ -z "$CSV_FILE" ] || [ ! -f "$CSV_FILE" ]; then
+  echo "Usage: $0 <csv_file>"
+  echo "CSV format: user_email,github_url,severity,points"
+  exit 1
+fi
+
+tail -n +2 "$CSV_FILE" | while IFS=, read -r email url severity points; do
+  echo "Processing: $email - $url"
+  ./scripts/link-github-bug-report.sh "$email" "$url" "$severity" "$points" "bulk_import"
+  sleep 0.5
+done
+
+echo "✓ Bulk import complete"
+```
+
+## FAQ
+
+**Q: Why aren't my GitHub reports showing automatically?**
+A: The Bug Bounty system was implemented after Season 1. Historical reports require manual verification and linking.
+
+**Q: How long does verification take?**
+A: Most requests are processed within 5 business days.
+
+**Q: What if I can't remember all the issues I reported?**
+A: Provide what you remember. We'll cross-reference with our GitHub issue tracker to find additional reports from your account.
+
+**Q: Do I get retroactive points?**
+A: Yes, verified historical reports receive the same points as if they were reported through the Bug Bounty system.
+
+**Q: What if my GitHub username is different from my Dex.Do username?**
+A: That's fine. Include both in your linking request, and we'll verify the connection.
+
+## Contact
+
+- Email: bounty@dex.do
+- Discord: #bug-bounty channel
+- Response time: 1-2 business days
diff --git a/migrations/20250615_add_github_bug_links.sql b/migrations/20250615_add_github_bug_links.sql
@@ -0,0 +1,69 @@
+-- Migration: Add GitHub bug report linking for Bug Bounty program
+-- Date: 2025-06-15
+-- Issue: #107
+
+BEGIN;
+
+-- Create table to track GitHub issue links
+CREATE TABLE IF NOT EXISTS bug_bounty_github_links (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  github_issue_url TEXT NOT NULL,
+  github_username TEXT NOT NULL,
+  verified_at TIMESTAMP NOT NULL DEFAULT NOW(),
+  verified_by TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('critical', 'high', 'medium', 'low')),
+  points_awarded INTEGER NOT NULL CHECK (points_awarded >= 0),
+  notes TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
+  CONSTRAINT unique_github_issue UNIQUE(github_issue_url)
+);
+
+-- Indexes for performance
+CREATE INDEX idx_github_links_user_id ON bug_bounty_github_links(user_id);
+CREATE INDEX idx_github_links_verified_at ON bug_bounty_github_links(verified_at DESC);
+CREATE INDEX idx_github_links_github_username ON bug_bounty_github_links(github_username);
+
+-- Add columns to users table if they don't exist
+DO $$ 
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM information_schema.columns 
+                 WHERE table_name='users' AND column_name='bug_bounty_points') THEN
+    ALTER TABLE users ADD COLUMN bug_bounty_points INTEGER NOT NULL DEFAULT 0;
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM information_schema.columns 
+                 WHERE table_name='users' AND column_name='bug_bounty_reports') THEN
+    ALTER TABLE users ADD COLUMN bug_bounty_reports INTEGER NOT NULL DEFAULT 0;
+  END IF;
+END $$;
+
+-- Create view for easy reporting
+CREATE OR REPLACE VIEW bug_bounty_leaderboard AS
+SELECT 
+  u.id,
+  u.email,
+  u.username,
+  u.bug_bounty_points,
+  u.bug_bounty_reports,
+  COUNT(bgl.id) as github_linked_reports,
+  COALESCE(SUM(bgl.points_awarded), 0) as github_points
+FROM users u
+LEFT JOIN bug_bounty_github_links bgl ON u.id = bgl.user_id
+WHERE u.bug_bounty_reports > 0 OR bgl.id IS NOT NULL
+GROUP BY u.id, u.email, u.username, u.bug_bounty_points, u.bug_bounty_reports
+ORDER BY u.bug_bounty_points DESC;
+
+-- Grant permissions
+GRANT SELECT ON bug_bounty_github_links TO readonly_user;
+GRANT SELECT ON bug_bounty_leaderboard TO readonly_user;
+
+COMMIT;
+
+-- Rollback script (save separately as rollback_20250615_add_github_bug_links.sql)
+-- BEGIN;
+-- DROP VIEW IF EXISTS bug_bounty_leaderboard;
+-- DROP TABLE IF EXISTS bug_bounty_github_links;
+-- ALTER TABLE users DROP COLUMN IF EXISTS bug_bounty_points;
+-- ALTER TABLE users DROP COLUMN IF EXISTS bug_bounty_reports;
+-- COMMIT;
diff --git a/scripts/bulk-import-github-reports.sh b/scripts/bulk-import-github-reports.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+set -euo pipefail
+
+CSV_FILE="$1"
+
+if [ -z "$CSV_FILE" ] || [ ! -f "$CSV_FILE" ]; then
+  echo "Usage: $0 <csv_file>"
+  echo ""
+  echo "CSV format (with header):"
+  echo "user_email,github_url,severity,points"
+  echo ""
+  echo "Example:"
+  echo "user@example.com,https://github.com/org/repo/issues/123,medium,50"
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LINK_SCRIPT="${SCRIPT_DIR}/link-github-bug-report.sh"
+
+if [ ! -x "$LINK_SCRIPT" ]; then
+  echo "Error: link-github-bug-report.sh not found or not executable"
+  exit 1
+fi
+
+TOTAL_LINES=$(tail -n +2 "$CSV_FILE" | wc -l | tr -d ' ')
+CURRENT=0
+SUCCESS=0
+FAILED=0
+
+echo "Starting bulk import of ${TOTAL_LINES} GitHub bug reports..."
+echo ""
+
+tail -n +2 "$CSV_FILE" | while IFS=, read -r email url severity points; do
+  CURRENT=$((CURRENT + 1))
+
+  email=$(echo "$email" | xargs)
+  url=$(echo "$url" | xargs)
+  severity=$(echo "$severity" | xargs)
+  points=$(echo "$points" | xargs)
+
+  echo "[${CURRENT}/${TOTAL_LINES}] Processing: ${email}"
+
+  if "$LINK_SCRIPT" "$email" "$url" "$severity" "$points" "bulk_import" 2>&1; then
+    SUCCESS=$((SUCCESS + 1))
+  else
+    FAILED=$((FAILED + 1))
+    echo "  ✗ Failed to process this entry"
+  fi
+
+  echo ""
+  sleep 0.5
+done
+
+echo "═══════════════════════════════════════"
+echo "Bulk import complete"
+echo "Total processed: ${TOTAL_LINES}"
+echo "Successful: ${SUCCESS}"
+echo "Failed: ${FAILED}"
+echo "═══════════════════════════════════════"
diff --git a/scripts/link-github-bug-report.sh b/scripts/link-github-bug-report.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+set -euo pipefail
+
+USER_EMAIL="$1"
+GITHUB_URL="$2"
+SEVERITY="$3"
+POINTS="$4"
+VERIFIED_BY="${5:-admin}"
+
+if [ -z "$USER_EMAIL" ] || [ -z "$GITHUB_URL" ] || [ -z "$SEVERITY" ] || [ -z "$POINTS" ]; then
+  echo "Usage: $0 <user_email> <github_issue_url> <severity> <points> [verified_by]"
+  echo "Example: $0 user@example.com https://github.com/org/repo/issues/123 medium 50"
+  exit 1
+fi
+
+if ! [[ "$POINTS" =~ ^[0-9]+$ ]]; then
+  echo "Error: Points must be a number"
+  exit 1
+fi
+
+if ! [[ "$GITHUB_URL" =~ ^https://github\.com/.+/issues/[0-9]+$ ]]; then
+  echo "Error: Invalid GitHub issue URL format"
+  exit 1
+fi
+
+GITHUB_USERNAME=$(echo "$GITHUB_URL" | sed -E 's|https://github\.com/([^/]+)/.*|\1|')
+
+psql "${DATABASE_URL}" <<SQL
+BEGIN;
+
+WITH user_lookup AS (
+  SELECT id, email FROM users WHERE email = '${USER_EMAIL}'
+),
+github_link AS (
+  INSERT INTO bug_bounty_github_links (
+    user_id, 
+    github_issue_url, 
+    github_username, 
+    severity, 
+    points_awarded, 
+    verified_by,
+    notes
+  )
+  SELECT 
+    user_lookup.id,
+    '${GITHUB_URL}',
+    '${GITHUB_USERNAME}',
+    '${SEVERITY}',
+    ${POINTS},
+    '${VERIFIED_BY}',
+    'Linked via manual verification script'
+  FROM user_lookup
+  WHERE user_lookup.id IS NOT NULL
+  ON CONFLICT (github_issue_url) DO NOTHING
+  RETURNING user_id, points_awarded
+)
+UPDATE users
+SET 
+  bug_bounty_points = COALESCE(bug_bounty_points, 0) + github_link.points_awarded,
+  bug_bounty_reports = COALESCE(bug_bounty_reports, 0) + 1,
+  updated_at = NOW()
+FROM github_link
+WHERE users.id = github_link.user_id;
+
+COMMIT;
+SQL
+
+if [ $? -eq 0 ]; then
+  echo "✓ Successfully linked GitHub issue to ${USER_EMAIL} (+${POINTS} points)"
+  echo "  Issue: ${GITHUB_URL}"
+  echo "  Severity: ${SEVERITY}"
+  echo "  Verified by: ${VERIFIED_BY}"
+else
+  echo "✗ Failed to link GitHub issue"
+  exit 1
+fi