News Date: 2026-07-22
GitHub is restructuring its bug bounty economics, cutting public rewards while creating a larger financial gap between ordinary participants and researchers accepted into its invite-only VIP program. The new payment schedule takes effect on July 27, 2026, although reports submitted before that date will remain eligible for the previous reward structure.
Public rewards fall sharply
Under the new public schedule, low-severity vulnerabilities will pay $250, medium findings $2,000, high-severity reports $5,000 and critical vulnerabilities $10,000. The previous critical range began at $20,000 and could exceed $30,000, meaning the standard reward for a serious public submission is being reduced considerably.
The VIP program offers a different scale. Invited researchers may receive $1,000 for low-severity issues, $7,500 for medium findings, $20,000 for high-severity vulnerabilities and at least $30,000 for critical reports. GitHub says researchers can become eligible based on a history of accepted findings, although reaching the stated thresholds does not necessarily guarantee an invitation.
AI is changing vulnerability disclosure
The policy arrives as generative AI and automated code analysis make it easier to produce large numbers of plausible vulnerability reports. Maintainers increasingly face submissions that look convincing but lack validation, realistic impact or a working proof of concept. Triage capacity, rather than basic vulnerability discovery, is becoming the scarce resource.
GitHub has already demanded stronger evidence from researchers, including reproducible demonstrations and clear explanations of security impact. The latest reward changes appear designed to direct more attention toward established researchers who consistently provide high-quality reports.
The risk of creating a closed research circle
I believe GitHub is addressing a genuine problem, but the solution introduces a strategic trade-off. A private group may produce cleaner reports and faster communication, yet public bounty programs are valuable precisely because they attract people with different backgrounds, techniques and assumptions.
Lower rewards and strict submission limits may discourage capable newcomers who have not yet built a reputation on a particular platform. That could narrow the pool of people examining one of the world's most important software development ecosystems.
What a balanced program needs
- Transparent and timely triage decisions.
- A clear path from public participation to VIP status.
- Appeal processes for disputed severity ratings.
- Recognition for verified research, even when financial rewards are smaller.
- Controls that filter automated noise without excluding new talent.
AI can accelerate vulnerability hunting, but human judgment still determines whether a weakness creates a meaningful attack path. GitHub's challenge is to reward that judgment without turning open security research into an insiders-only market.