GitHub's shift toward a quality-over-quantity model addresses the industry-wide challenge of AI-generated report spam. By incentivizing deep research through a VIP tier, they aim to focus engineering resources on high-impact vulnerabilities rather than triaging low-signal noise.
The security research community makes GitHub safer for everyone. That’s the simple idea behind our bug bounty program.
For more than a decade, researchers from around the world have helped us find and fix vulnerabilities before they could be exploited, and we’ve worked hard to be a program worth their time.
Today, we’re sharing some meaningful changes to how the program works. These decisions comes after months of reflecting on our program, analyzing what’s happening across the industry, and thinking about researcher experience.
The program is facing an increasing queue. We have already made adjustments to accommodate the rise in new researchers and the acceleration in efforts of researchers we’ve been working with. We shared these changes in a recent blog post.
These changes are about two things: reducing the noise so we can focus on the signal, and building a program that serious researchers find rewarding to participate in.
We’re formalizing a permanent private/invite-only VIP program for qualified researchers who consistently deliver high-quality, high-impact work. VIP researchers get higher payouts, faster response times, and a closer working relationship with our security engineering team. The goal is to create a space where the researchers who invest deeply in understanding GitHub can work with us directly and get an experience that reflects the effort they put in.
VIP program bounty table:
| Severity | Payout |
|---|---|
| Low | $1,000 |
| Medium | $7,500 |
| High | $20,000 |
| Critical | $30,000+ |
How to qualify: We’ll publish clear criteria on our public HackerOne page. The path in is built around demonstrated, consistent quality. To qualify, you must accomplish at least one of the following:
The core shift here is in what we’re incentivizing: you don’t earn more by submitting more. You earn more by submitting better.
To commit ourselves to the changes in our prioritization above, we also must make changes that enable it. We are adjusting our public program rates to accommodate this shift in focus towards quality of relationships and findings over quantity of reports. We are also updating to static payouts—a single, clear number per severity level, rather than a wide range. Ranges sound flexible, but in practice they create uncertainty for researchers and overhead for our team. Static payouts set clear expectations on both sides, and we retain the ability to award discretionary bonuses for work that goes above and beyond.
Our new public program bounty table:
| Severity | Payout |
|---|---|
| Low | $250 |
| Medium | $2,000 |
| High | $5,000 |
| Critical | $10,000 |
This adjustment will enable us to provide more tailored attention and higher rewards to our VIP program, while still enabling our public program to be a place to explore and serve as a feeder into the VIP program.
To reduce the volume of low-effort and AI-generated reports, we’re implementing a HackerOne signal requirement on the public program. Researchers who don’t yet meet the signal threshold will have a limited number of allowed submissions while they establish a track record.
This isn’t a wall against new researchers. HackerOne’s platform gives researchers who don’t meet the threshold up to four initial submissions, which is enough runway for a newcomer with a genuine finding to demonstrate their skills. We want to remain accessible to the full security research community; we just need a baseline that keeps the program workable for everyone.
Our commitment to rewarding real security research isn’t changing. We’ll continue to pay out quickly, communicate clearly, and treat researchers as the partners they are.
Reports submitted before these changes take effect will be honored under the previous bounty structure. We’re grandfathering the backlog so that only reports made on or after July 27, 2026 will be assessed with the new structure.
This is one part of the broader evolution we’re working through. Alongside the bounty restructuring and the VIP program, we’re investing in faster response times, clearer severity reasoning, and more community engagement. Great working relationships are built on more than a pay table. You can engage directly with us at conferences like DEFCON and you’ll hear from us through ongoing outreach. We look forward to joining the researcher community at security conferences, building relationships, and continuing to explore ways to make our bug bounty program one that rewards the kind of deep, thoughtful research we care about most.
The security research community is one of GitHub’s greatest assets. These changes are meant to honor them. We want to build a program that attracts the research we value, creates an experience that reflects how seriously we take this work, and upholds the trust researchers place in us every time they submit a report.
We’ll see you out there, and happy hacking!
The post Next chapter: Restructuring GitHub’s bug bounty program appeared first on The GitHub Blog.
Continue reading on the original blog to support the author
Read full articleThis milestone signals a shift toward a sustainable open source ecosystem. By providing direct financial support, it helps secure the software supply chain, reduces maintainer burnout, and allows developers to treat critical open source work as a viable, full-time career.
Mastering Git and GitHub is foundational for modern software engineering. It enables version control, secure collaboration, and participation in the global open-source community, ensuring code integrity and efficient team workflows.
Clear repository ownership is critical for security remediation and incident response. By automating ownership validation via custom properties, GitHub eliminated technical debt, archived thousands of stale repos, and ensured every active project has a direct point of contact.
Documentation often lags behind code due to context switching and cross-repo security hurdles. This approach uses agentic workflows to automate drafting while maintaining security guardrails, ensuring docs ship alongside features without manual overhead.
