GitHub Slashes Public Bug Bounty Payouts, Pushes Top Rewards to Secret VIP Program

Michael Miller · 2026-07-22

If you've been hunting for bugs on GitHub's public bounty program, you might want to sit down for this. Starting July 27, 2026, GitHub is slashing public payouts by at least half at every severity level. That means critical findings, which once earned you between $20,000 and $30,000 or more, will now get a flat $10,000. Meanwhile, a permanent invite-only VIP tier will offer $30,000 or more for the same level of work. Reports filed before that cutoff date, including those stuck in GitHub's ever-growing triage queue, will still be paid under the old terms. So if you've got something in the pipeline, you're safe. But for new submissions after that date, the game has changed. ### Why GitHub Is Making This Move GitHub says the change is about streamlining operations and rewarding the most trusted researchers. But let's be real: it's also about controlling costs. The company has seen a surge in bug reports over the past year, and triaging them all takes time and money. By moving top rewards to an invite-only tier, GitHub can focus on a smaller, vetted group of researchers while cutting public payouts across the board. This isn't entirely new. Many companies have experimented with invite-only programs, but GitHub's move is notable because of its scale. With millions of repositories and a massive user base, GitHub's bug bounty program is one of the most visible in the industry. This shift could set a precedent for other platforms. ### What This Means for Bug Hunters For independent researchers, this is a mixed bag. On one hand, the public program still pays, just less. On the other, the VIP tier is a closed club, and getting in won't be easy. You'll need a proven track record and likely an invitation from GitHub itself. That creates a two-tier system: the elite get top dollar, while everyone else gets crumbs. - **Public tier**: Critical bugs now pay $10,000 flat, down from $20,000-$30,000+ - **VIP tier**: Critical bugs pay $30,000 or more, but it's invite-only - **Other severity levels**: Also cut by at least half If you're serious about bug hunting, you'll need to build a reputation fast. Focus on quality over quantity. One solid critical finding could get you noticed and potentially invited to the VIP program. ### How to Prepare for the Change You've still got time before July 27, 2026. Here's what you can do: 1. **Submit any pending reports now** – If you've found something, file it before the cutoff to lock in the old payout. 2. **Network with other researchers** – Getting an invite often comes through connections. Join forums, attend conferences, and build relationships. 3. **Specialize in high-impact bugs** – GitHub is looking for researchers who find critical vulnerabilities, not just low-hanging fruit. ### The Bigger Picture This move reflects a broader trend in the cybersecurity world. Companies are getting more selective about who they trust with their most sensitive data. Public bug bounties are great for casting a wide net, but they also attract noise. By creating a VIP tier, GitHub can filter out the noise and focus on proven talent. But it also raises questions about fairness. Bug hunting is already a competitive field, and this change makes it harder for newcomers to break in. If you're just starting out, you'll need to be patient and persistent. The public program still offers a path, but the rewards are smaller. ### Final Thoughts GitHub's decision is a reminder that bug bounty programs are businesses, not charities. They exist to improve security, but they also have to make financial sense. For researchers, the key is to adapt. Build your skills, network like crazy, and aim for the VIP tier. That's where the real money is now. And if you're already in the triage queue? Lucky you. Your payout is safe. For everyone else, the clock is ticking.