GitHub Slashes Public Bug Bounty Payouts, Reserves Top Rewards for VIPs

Key points

• GitHub is cutting public bug bounty payouts by at least half at every severity level, effective July 27, 2026.
• Critical vulnerability payouts drop from a range of $20,000 to $30,000 or more down to a fixed $10,000.
• An invite-only VIP tier retains rewards of $30,000 or more for critical finds.
• Reports already filed or sitting in GitHub's triage queue before that date keep the old payout terms.

GitHub is halving what it pays public researchers for security flaws. The change takes effect July 27, 2026. Every severity level is affected.

Bug bounty programs pay independent researchers to find and report vulnerabilities, which are flaws in software that attackers can exploit, before those flaws become weapons. GitHub's public program has until now paid between $20,000 and $30,000 or more for critical findings. After July 27, that drops to a flat $10,000. A researcher who lands a critical bug on GitHub's platform will earn one-third of what the same class of finding might have paid last month. That gap is not small.

The big payouts don't disappear. They move. GitHub is routing them into a permanent invite-only VIP tier that starts at $30,000 for critical reports. Researchers don't apply for that tier; GitHub selects them. No criteria for selection have been published.

Reports filed before the cutoff date are protected, including those already waiting in GitHub's triage queue, the internal list where the company sorts and prioritises incoming submissions.

First reported by The Hacker News, this looks like a straightforward cost-control move dressed in the language of focus. GitHub gets to pay less to most researchers while telling its best-known contributors that nothing has changed for them. Whether that framing holds depends entirely on how the VIP list is managed and how often it grows.

Why is GitHub changing its payments?

GitHub hasn't published a detailed rationale, but the structure of the change points toward two goals: reducing overall bounty spend and concentrating the highest rewards on the researchers it already trusts. An invite-only tier costs less to run than a fully open program at the same payout level, and it lets GitHub direct money to findings it considers highest priority.

For context, Meta paid a researcher $78,000 in late July for a flaw in its internal support system, a figure that now sits well above what GitHub will offer any public researcher for a critical find. That comparison will not be lost on the research community.

Should you worry?

If you use GitHub to store or collaborate on code, the practical security picture doesn't change overnight. Researchers will still submit bugs. The platform will still patch them. What shifts is the incentive structure for the people doing that work, and lower public payouts may nudge some researchers toward programs that pay more.

For researchers outside the VIP tier, the calculus is blunt. The ceiling just dropped by at least two-thirds for critical findings. Reputation in the community has always mattered for access to private programs, and that's now more true on GitHub than it was last week. We've tracked the bug bounty space closely this year, and this is the first time we've seen a major platform formalize a two-tier payout structure this explicitly. Watch whether others follow.

Common questions

When does the new payout structure take effect?

July 27, 2026. Reports submitted before that date, including any already queued for triage, keep the previous payout terms.

What does the VIP tier pay?

At least $30,000 for critical findings. Membership is by invitation only and GitHub has not disclosed how researchers qualify.

What will public researchers receive for a critical finding after July 27?

A fixed $10,000, down from a range that previously reached $30,000 or more.