GitHub Restructures Its Bug Bounty Program
Top rewards for critical vulnerabilities move to an invite-only VIP tier.
1GitHub's New Reward Structure
Starting July 27, 2026, GitHub will reduce public bug bounty payouts by at least half across all severity levels. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent VIP tier will offer $30,000 or more. This change aims to incentivize higher-quality reports from researchers.
2Fixed Payments and Their Benefits
GitHub is replacing flexible payment ranges with fixed amounts in its public program: $250 for low, $2,000 for medium, $5,000 for high, and $10,000 for critical findings. The company states this will eliminate uncertainty and streamline the triage process, though discretionary bonuses may still apply for exceptional work.
3How to Qualify for the VIP Program
Researchers can qualify for the invite-only VIP tier by reporting at least one critical, two high, four medium, or seven low-severity vulnerabilities. GitHub hasn't specified timeframes for meeting these thresholds or guaranteed invitations. VIP members gain faster responses and direct access to the security engineering team.
4AI's Impact on Security Research
GitHub's decision coincides with AI making vulnerability discovery more accessible. Google's new Gemini 3.5 Flash Cyber model can find and patch software flaws. Such tools accelerate internal code reviews while potentially devaluing external reports, reshaping the bug bounty landscape.
5Curl's Experience with AI Reports
The curl project ended its cash bounty program in January 2026 after AI-generated junk reports drove its confirmation rate below 5%. By April, after removing rewards, report volume doubled but quality improved—15-16% were valid vulnerabilities. Maintainers noted most submissions appeared AI-assisted yet high-quality.
6The Future of Security Research
GitHub's policy reflects the growing influence of AI-assisted research. While aiming to reduce noise, it may raise barriers for new researchers. The security ecosystem is balancing automation's efficiency with human expertise in complex analysis, exploit chaining, and understanding business logic flaws.
Original article: The Hacker News — GitHub Hata Ödül Programını Yeniden Yapılandırıyor