GitHub Bug Bounty Program Overhaul

GitHub is implementing significant changes to its bug bounty program, aiming to improve the experience for security researchers and streamline its internal processes. The move comes after months of analysis and reflection on industry trends and researcher feedback. According to the announcement, the adjustments are designed to reduce noise and focus on high-impact findings.

Introducing a Permanent VIP Program

A new, permanent invite-only VIP program is being formalized for researchers who consistently deliver high-quality, high-impact work. These top-tier researchers will receive enhanced benefits, including higher payouts, expedited response times, and direct collaboration with GitHub's security engineering team. The goal is to foster deeper relationships with dedicated researchers.

VIP bounty tiers are set at $1,000 for low severity, $7,500 for medium, $20,000 for high, and $30,000+ for critical findings. Qualification requires demonstrating consistent quality, such as submitting one critical, two high, four medium, or seven low-severity findings. The program emphasizes earning more by submitting better, not just more, reports.

Restructured Public Bounty Table

The public bug bounty program is also seeing adjustments. Payouts are shifting to static amounts per severity level to provide clearer expectations and reduce administrative overhead. The new public bounty table offers $250 for low, $2,000 for medium, $5,000 for high, and $10,000 for critical vulnerabilities. These changes aim to allow more tailored attention and higher rewards for the VIP program while keeping the public program accessible and serving as a pipeline for new talent.

Raising the Signal Requirement

To mitigate the influx of low-effort and AI-generated reports, GitHub is introducing a HackerOne signal requirement for the public program. Researchers below the signal threshold will have a limited number of submissions allowed as they build their track record. HackerOne provides up to four initial submissions for newcomers, offering sufficient opportunity for genuine findings to be demonstrated.

GitHub's commitment to rewarding security research remains unchanged. Payouts will continue to be prompt, communication clear, and researchers treated as partners. Reports submitted before July 27, 2026, will be honored under the previous bounty structure, with the new system applying only to submissions made on or after that date.

Looking ahead, GitHub is investing in faster response times, clearer severity reasoning, and increased community engagement, including participation in conferences like DEFCON. These GitHub bug bounty program changes are part of a broader evolution to build a program that attracts valued research and upholds researcher trust.