GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
GitHub will reduce public bug bounty payouts by at least half at every severity level starting on July 27, 2026. While its permanent invite-only VIP category will pay $30,000 or more, critical findings will go from $20,000 to $30,000+ to a constant $10,000.
The prior compensation terms will be applied to reports submitted prior to that date, including those that are now in GitHub's expanding triage queue.
According to GitHub, the modifications are meant to decrease noise while providing more prizes, quicker responses, and easier access to its security engineering team for seasoned researchers. According to the company, submitting more does not increase your earnings. "You are paid more when you submit more effectively.
Fixed payments are replacing flexible ranges in the public pr...

