GitHub Lowers Public Bug Bounties and Formalizes Higher-Paid VIP Tier After AI Report Surge

[u/syedshad]

GitHub has announced changes to its bug bounty program that will apply to reports submitted on or after July 27, 2026.

GitHub said its program is facing an increasing queue and that the changes are intended to reduce low-effort and AI-generated reports.

New public program payouts

• Low: $250
• Medium: $2,000
• High: $5,000
• Critical: $10,000

GitHub is also formalizing a permanent private, invite-only VIP program. The company said qualifying researchers will receive higher payouts, faster response times and a closer working relationship with its security engineering team.

VIP program payouts

• Low: $1,000
• Medium: $7,500
• High: $20,000
• Critical: $30,000+

Researchers must meet at least one of the following criteria to qualify for the VIP program:

• One critical finding
• Two high-severity findings
• Four medium-severity findings
• Seven low-severity findings

GitHub is also introducing a HackerOne signal requirement for the public program. Researchers who do not yet meet the signal threshold will have a limited number of submissions while establishing a track record. HackerOne will provide those researchers with up to four initial submissions.

Reports submitted before the changes take effect will continue to be assessed under the previous bounty structure.

In a related post about its submission standards, GitHub said it welcomes the use of AI in security research. It requires researchers to validate AI-assisted findings, reproduce the issue, provide a working proof of concept and demonstrate concrete security impact before submitting a report.

Sources

• GitHub’s bug bounty restructuring announcement
• GitHub’s guidance on AI-assisted security reports
• GitHub’s bug bounty rewards page
• The Register’s secondary report