GitHub to Cut Public Bug Bounty Payouts by at Least Half, Reserve Top Rewards for VIPs
Summary
GitHub says it will cut public bug-bounty payouts by at least half from July 27, fixing rates and reserving rewards of $30,000 or more for invite-only VIPs. The article links the change to AI-driven report volume and changing research workflows.
Key points
- Starting July 27, GitHub plans to replace public payout ranges with fixed payments: $250 for low, $2,000 for medium, $5,000 for high, and $10,000 for critical findings.
- Critical findings in the invite-only VIP tier can earn $30,000 or more. Reports submitted before the cutoff retain the previous payout terms.
- Researchers may qualify for the private program by reporting one critical, two high, four medium, or seven low-severity vulnerabilities; GitHub has not specified a time window, and meeting the thresholds does not guarantee an invitation.
- GitHub says the changes aim to reduce noise and reward higher-quality research. Researchers below its undisclosed HackerOne Signal threshold will receive up to four initial submissions.
- Google says Gemini 3.5 Flash Cyber found 55 unique confirmed V8 issues in its tests. Google also reported a production-service exploit result; these claims have not been independently verified.
- Curl maintainer Daniel Stenberg said that after the project ended cash rewards, submissions reached about twice the 2025 rate by April, with 15–16% confirmed as vulnerabilities.
Article Details
- Event Type
- GitHub bug bounty program payout and eligibility policy change
- Impact
- Starting July 27, 2026, GitHub plans to replace flexible public rewards with fixed payments at least 50% lower across severity levels, including $10,000 for critical findings. Critical rewards of $30,000 or more will be reserved for an invite-only VIP tier. Reports submitted before the cutoff retain the previous terms. The change may reduce noise and prioritize higher-quality reports, while making access to top rewards more selective.
People
Vendors
GitHubGitHub will halve its public bug bounty payouts starting July 27, 2026, replacing flexible reward ranges with fixed payments while reserving its highest payouts for an invite-only VIP tier.GoogleThe change comes as AI-driven security research increases report volume and noise, with GitHub, Google, and curl all adjusting to faster automated finding, validation, and triage workflows.HackerOne#GitHub
Products
CodeMender#GitHubCodex SecuritySystems such as OpenAI’s Codex Security can then test findings, generate working proofs of concept, and propose fixes that account for system intent and surrounding behavior.curlThe change comes as AI-driven security research increases report volume and noise, with GitHub, Google, and curl all adjusting to faster automated finding, validation, and triage workflows.Gemini 3.5 Flash CyberA day before GitHub’s announcement, Google introduced Gemini 3.5 Flash Cyber, a lightweight model fine-tuned to find, validate, and patch software vulnerabilities.GitHubGitHub will halve its public bug bounty payouts starting July 27, 2026, replacing flexible reward ranges with fixed payments while reserving its highest payouts for an invite-only VIP tier.