GitHub is cutting public bug bounty payouts by at least half across all severity levels from July 27, 2026. The change affects reports filed after this date. Critical bug findings will now receive a fixed $10,000, down from $20,000-$30,000+.
The platform's decision to reduce rewards is accompanied by the introduction of a permanent, invite-only VIP tier, which will pay $30,000 or more for top findings.
GitHub's new payout structure significantly alters the incentives for researchers reporting vulnerabilities. Previously, critical findings could yield substantial rewards. The shift to a fixed lower amount may affect the number and quality of submissions.
The exclusive VIP tier suggests that GitHub is prioritizing a select group of researchers for high-stakes bug hunting. This could lead to a concentration of top talent within the invite-only program.
The reduction in bug bounty payouts raises concerns about the future of vulnerability reporting on GitHub. With lower rewards, some researchers may be deterred from investing time and effort into discovering and reporting bugs.
As a result, GitHub may see a decrease in the number of bug reports or a shift towards more lucrative bug bounty programs. The long-term impact on the platform's security remains to be seen.
What happens to reports filed before July 27, 2026? Reports filed before this date will not be affected by the new payout structure. How will researchers be selected for the VIP tier? The selection process for the VIP tier is not publicly disclosed, as it is an invite-only program. Will GitHub's security be compromised by the changes? The impact on security is uncertain, but a decrease in bug reports could potentially leave vulnerabilities unaddressed.