GitHub is restructuring its bug bounty program, reducing payouts for public submissions while consolidating higher rewards into an exclusive VIP tier starting July 27, 2026.
Critical severity vulnerabilities submitted through the public program will see payouts cut from $20,000-$30,000+ to a flat $10,000. Researchers operating in the invite-only VIP tier will continue receiving $30,000 or more for critical findings. Medium and low severity reports will face comparable reductions across the board.
The shift creates a two-tiered bounty system. Reports submitted before July 27 retain current payout rates, providing a window for researchers to file findings under existing terms. Reports already in GitHub's triage queue maintain their original reward structures.
GitHub has not clarified the criteria for VIP tier selection or how researchers gain access to the higher-paying program. This opacity raises questions about whether the move privileges established security researchers while disadvantaging newer contributors or those without industry connections.
Bug bounty program restructuring typically signals budget constraints or shifting priorities. GitHub's move follows industry patterns where platforms reduce public-facing rewards while maintaining premium rates for vetted researchers. The $10,000 cap for critical public submissions remains competitive within the market, but the reduction represents a material change for independent researchers relying on bounty income.
The practical effect narrows the financial incentive for public participation. Researchers lacking VIP access face halved earnings while tackling the same vulnerability classes. This may shift researcher behavior toward platforms with more generous public programs, potentially reducing the quantity and velocity of public submissions to GitHub's platform.
Organizations depending on GitHub's bug bounty program for security testing should anticipate changes in researcher engagement post-July 27. Companies offering higher public bounties or maintaining transparent VIP selection processes typically attract stronger researcher participation. GitHub's move reflects broader industry consolidation of top rewards within closed programs.