Restructuring GitHub's bug bounty program
github.blog
July 23, 2026
5 min read
🔥🔥🔥🔥🔥
43/100
Summary
GitHub is restructuring its bug bounty program to enhance collaboration with the security research community and improve overall platform safety. Changes to the program aim to better recognize and reward researchers for identifying and reporting vulnerabilities.
Key Takeaways
- GitHub has restructured its bug bounty program to focus on quality over quantity, introducing a VIP program for high-performing researchers with higher payouts and faster response times.
- The new public bounty table features static payouts: $250 for low severity, $2,000 for medium, $5,000 for high, and $10,000 for critical vulnerabilities.
- A signal requirement will limit submissions from new researchers until they establish a track record, while still allowing up to four initial submissions for newcomers.
- GitHub will continue to honor reports submitted before the changes under the previous bounty structure.
Community Sentiment
Positives
- The shift towards a VIP program for high-quality researchers could lead to more impactful vulnerability reports, benefitting GitHub's security posture.
- Creating a structure that rewards quality over quantity might streamline the bug reporting process, leading to better overall outcomes for the platform.
Concerns
- Capping payouts for critical vulnerabilities at $10,000 could deter skilled researchers from reporting, possibly pushing them to sell findings to less ethical buyers.
- The system feels like a way to prioritize corporate interests over genuine security contributions, which could alienate independent researchers.
