GitHub cuts public bug bounty payouts by at least half starting July 27, 2026, with critical findings dropping to $10,000. But a new invite-only VIP tier pays $30,000+ for the same bugs. Learn what this means for security researchers.
If you're a security researcher hunting for vulnerabilities on GitHub, you might want to sit down for this one. Starting July 27, 2026, GitHub is cutting public bug bounty payouts by at least half at every severity level. That means a critical finding that could have earned you between $20,000 and $30,000 or more will now fetch a fixed $10,000. Ouch, right?
But here's the twist—GitHub isn't just slashing rewards across the board. They're also rolling out a permanent, invite-only VIP tier that pays $30,000 or more for the same level of critical bugs. So, while the public program takes a hit, there's a shiny, exclusive door opening for a select few.
### What's Changing and When?
The new payout structure kicks in on July 27, 2026. Here's a quick breakdown of what's shifting:
- **Critical vulnerabilities**: Drop from $20,000-$30,000+ to a flat $10,000 in the public program.
- **High, medium, and low severity**: Also cut by at least half, though exact numbers vary.
- **VIP tier**: Invite-only, pays $30,000+ for critical finds.
Reports filed before that date, including those already sitting in GitHub's growing triage queue, will keep the old payout terms. So if you've got a report in the pipeline, you're safe.
### Why the Change?
GitHub says the move is about focusing resources on the most impactful vulnerabilities. They want to reward researchers who consistently deliver high-quality findings, and the VIP tier is their way of doing that. It's a classic case of "if you're good, you'll get invited to the cool table."
But let's be real—this also creates a two-tier system. Public researchers might feel like they're being pushed out, while the VIPs get the cream. And if you're new to bug hunting, breaking into that exclusive club could be tough.
### What This Means for You
If you're a security researcher, this change could reshape how you approach GitHub's bug bounty program. Here are a few things to consider:
- **Timing is everything**: Get your reports in before July 27, 2026, to lock in the higher payouts.
- **Quality over quantity**: Focus on delivering top-notch findings to catch GitHub's eye for a VIP invite.
- **Diversify your targets**: Don't put all your eggs in GitHub's basket. Other platforms still offer solid rewards.
### The Bigger Picture
This shift isn't happening in a vacuum. Other tech giants like Google and Microsoft have experimented with invite-only programs, and it's a trend that's gaining traction. The idea is to reduce noise from low-quality reports and build a trusted community of elite researchers.
But critics argue it could discourage newcomers and limit the diversity of security talent. After all, some of the best bugs are found by people who aren't part of the "in crowd."
### What Should You Do Next?
First, don't panic. If you're already active on GitHub's bounty program, keep doing what you're doing—just aim for that VIP status. If you're new, consider starting with other platforms to build your reputation before trying to break into GitHub's elite tier.
And remember, the security research community is full of opportunities. This change might sting now, but it could also push you to explore new avenues and grow your skills.
### Final Thoughts
GitHub's move is a double-edged sword. It rewards the best while leaving others in the dust. But if you're serious about bug hunting, adapt, evolve, and keep pushing. The VIP tier might be exclusive, but it's not impossible to reach.
Stay sharp, keep hacking, and who knows—you might just earn that $30,000 reward.
