GitHub revamps bug bounty program with new VIP tier, payout changes

GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports.

The changes will take effect on July 27, 2026. Reports submitted before that date will be honored under the previous bounty structure.

“Alongside the growth in legitimate reports, we’ve seen a sharp increase in submissions that don’t demonstrate real security impact. These include reports without a proof of concept, theoretical attack scenarios that don’t hold up under scrutiny, and findings already covered by our published ineligible list,” Jarom Brown, Senior Product Security Engineer, Bug Bounty at GitHub, explained.

VIP program and payout changes

GitHub is formalizing a permanent, private, invite-only VIP program for researchers who consistently deliver high-quality, high-impact findings. Participants will receive higher payouts, faster response times, and closer collaboration with GitHub’s engineering team.

VIP program bounty table (Source: GitHub)

The company said the eligibility criteria will be published on its public HackerOne page. To qualify, participants must meet at least one of the following thresholds: one critical finding, two high-severity findings, four medium-severity findings, or seven low-severity findings.

Public bug bounty payouts are also being restructured. The new table assigns a single payout to each severity level to simplify expectations for researchers while allowing GitHub to award discretionary bonuses for exceptional submissions.

“This adjustment will enable us to provide more tailored attention and higher rewards to our VIP program, while still enabling our public program to be a place to explore and serve as a feeder into the VIP program,” Catherine Cassell, Product Security Engineer at GitHub, said.

New signal requirement for researchers

GitHub is also introducing HackerOne’s signal requirement to reduce low-effort and AI-generated reports while keeping the program accessible to new researchers. Under the requirement, newcomers can make up to four initial submissions while they establish signal in the public program.

Researchers who do not meet the signal threshold will have a limited number of allowed submissions until they establish a track record.