GitHub Slashes Public Bug Bounty Rewards, Shifts Top Payouts to Invite-Only VIP Tier

Introduction

GitHub has unveiled a significant revision to its bug bounty program that will take effect on July 27, 2026. The platform is cutting the public reward amounts for every severity tier, with critical vulnerabilities now earning a flat $10,000 instead of the previous range of $20,000‑$30,000+. At the same time, the permanent invite‑only VIP tier will retain the ability to pay $30,000 or more for exceptional submissions. Importantly, any vulnerability reports filed before the cutoff date—including those already sitting in GitHub’s triage queue—will be compensated under the original payout schedule.

Details of the New Payout Structure

Under the updated policy, the public bounty schedule is being standardized across low, medium, high, and critical findings. Low‑severity issues will see payouts drop from a few hundred dollars to a fixed $500, medium findings will move from roughly $1,000‑$2,000 to a set $1,000, high‑severity reports will be reduced from $5,000‑$8,000 to a flat $3,000, and critical bugs will be capped at $10,000. This represents a reduction of at least 50 % across the board. The VIP tier, which remains invitation‑only and is based on a researcher’s historical performance and reputation, will continue to offer flexible rewards that start at $30,000 and can exceed that amount for particularly impactful discoveries.

Impact on Security Researchers and the Community

The change is likely to affect a broad segment of the security research community that relies on GitHub’s public program for income and recognition. Researchers who primarily submit lower‑ to medium‑severity bugs may find the new fixed amounts less attractive compared to the variable rewards they previously earned. Conversely, top‑tier contributors who have already earned VIP status may see little change, as their earning potential remains high. The move could also encourage researchers to diversify their reporting across multiple platforms or private programs that still offer variable, high‑value payouts for critical findings.

Why GitHub Is Making This Change

GitHub has not disclosed the exact motivations behind the reduction, but industry analysts point to several plausible factors. Maintaining a large, open bounty pool can become financially unsustainable as the volume of submissions grows, especially when high‑value payouts are frequent. By standardizing public rewards, GitHub can better predict its security spending while still incentivizing participation. The VIP tier serves as a loyalty mechanism, rewarding consistent, high‑quality contributors and fostering a tighter relationship with elite researchers. Additionally, the shift may align GitHub’s bounty economics with broader trends where companies allocate larger budgets to private, invite‑only programs that offer higher discretionary awards.

Conclusion

GitHub’s decision to halve public bug bounty payouts while preserving top rewards for an exclusive VIP group marks a pivotal shift in how major platforms balance openness with fiscal responsibility. The change acknowledges the growing scale of security research while striving to retain elite talent through targeted incentives. As the ecosystem evolves, leveraging advanced AI for early detection and prioritization—services that Grivyonx Cloud provides—can help both platforms and researchers maximize the value of every submission, ensuring that critical vulnerabilities are addressed promptly and fairly.