GitHub Just Halved Its Bug Bounty Payouts — Here’s What Actually Changed

Starting July 27, 2026, public rewards drop by 50–59% across the board, while a new invite-only VIP tier pays up to 3x more for the same severity

If you hunt bugs on GitHub's public program, your next critical finding is about to be worth a lot less — unless you've already earned your way into a tier most researchers don't even know exists yet.

Starting July 27, 2026, GitHub is cutting its public bug bounty payouts by at least half at every severity level, while quietly building out a permanent, invite-only "VIP" tier that pays significantly more for the same class of bug. Reports filed before the cutoff — including anything already sitting in GitHub's triage queue — keep the old payout terms.

In this article: exactly what's changing, how the new VIP tier works, why GitHub says it's doing this, and what it signals about the future of bug bounty programs in an AI-saturated research landscape.

The new numbers

GitHub is replacing its old flexible payout ranges with fixed, non-negotiable amounts for the public program:

Severity New public payout Old range Change Low $250 $617–$2,000 ~59% lower Medium $2,000 $4,000–$10,000 50% lower High $5,000 $10,000–$20,000 50% lower Critical $10,000 $20,000–$30,000+ 50%+ lower

Compare that to the new VIP schedule, available only by invitation: $1,000 for low, $7,500 for medium, $20,000 for high, and $30,000 or more for critical — roughly triple the public rate at the top end.

GitHub frames the shift bluntly: quantity of submissions no longer matters, only quality does. The company says fixed payments should cut down on both uncertainty for researchers and triage overhead on its own side, though it's left the door open for discretionary bonuses on exceptional findings.

How to actually get into the VIP tier

Qualification is based on a cumulative track record, not a single big find. Researchers can qualify by reporting at least one critical, two high, four medium, or seven low-severity vulnerability over time. What's notably missing from GitHub's announcement: any defined time window for hitting those thresholds, and any confirmation that meeting them guarantees an actual invitation. Fuller criteria are expected to land on GitHub's public HackerOne program page.

There's also a quality gate on the way in: GitHub hasn't disclosed the HackerOne "Signal" score threshold it will enforce, but researchers who fall below it will be capped at four initial submissions — mirroring HackerOne's broader platform-wide rule that gives new researchers four trial reports per program within a rolling 30-day window.

Why now: AI changed the economics of finding bugs

This restructuring isn't happening in a vacuum. It follows GitHub's own May 2026 policy tightening, which already required working proof-of-concept exploits, demonstrated impact, and pre-submission validation. But the bigger backdrop is what AI has done to the supply of candidate vulnerability reports.

The same week as this announcement, Google introduced Gemini 3.5 Flash Cyber, a lightweight model fine-tuned specifically to find, validate, and patch software vulnerabilities — initially rolled out to governments and trusted partners through Google's CodeMender agent. In Google's own benchmark tests, it found 55 unique confirmed V8 engine issues, ahead of both mainline Gemini 3.5 Flash (47) and Claude Opus 4.6 (36). Google also reported that its internal Cloud Vulnerability Research team used the model to uncover remote code execution flaws in public APIs and a memory-corruption bug in a production service within two hours — then generate a fully reliable exploit for it. Worth flagging: those figures are Google-reported and haven't been independently verified.

The pattern isn't unique to GitHub either. Curl maintainer Daniel Stenberg cut the project's cash bug bounty entirely at the end of January 2026, after its confirmed-vulnerability rate fell below 5% amid a wave of AI-generated junk reports. By April, after curl had dropped cash rewards and returned to a HackerOne-hosted program, submissions were arriving at roughly double the 2025 rate — but with confirmation rates recovering to 15–16%, and Stenberg noting that nearly every report now appeared AI-assisted and most were high quality.

What this actually signals

Put together, GitHub's payout restructuring, Google's AI-assisted vulnerability research, and curl's submission-volume swings all point at the same underlying shift: generating a plausible-looking candidate vulnerability report is becoming cheap and abundant. What remains scarce — and increasingly valuable — is everything downstream of that: careful triage, a working exploit proof, deep product context, responsible disclosure, and real remediation.

That's arguably the whole logic behind GitHub's new structure. A flat $10,000 for a verified critical finding, versus $30,000+ for the same severity inside the VIP tier, is GitHub pricing in exactly that distinction — first-pass discovery is getting cheaper, verified and product-specific impact is where the premium now sits.

The trade-off worth watching

There's a real tension buried in this move. Tighter signal requirements and lower public rewards should suppress automated noise — but they can also raise the barrier to entry for genuinely capable researchers who simply haven't built up a HackerOne track record yet. A four-report cap leaves very little room for a newcomer's early mistakes, unfamiliarity with GitHub's specific security model, or a legitimate finding that initially gets scored lower than it deserves.

Concentrating GitHub's closest researcher relationships inside an invite-only tier may well improve speed and average report quality. But it also narrows the pool of people actively poking at the platform — which has historically been one of the core advantages of running a public program in the first place.

As of press time, there's also a real gap between policy and practice: GitHub's own public rewards page still listed the old $20,000-$30,000+ critical range, and its FAQ still referenced the previous VIP eligibility bar (at least $20,000 earned and two reports submitted over the preceding two years, with quarterly review — not a guarantee).

The takeaway

If you're an active bug hunter on GitHub's program, the message is straightforward: submission volume alone won't get you paid the way it used to. Building a track record of confirmed, high-quality, well-documented findings — the kind that earns a VIP invite — is now the clearer path to meaningful payouts. For everyone else, this is a preview of where bug bounty economics across the industry may be headed as AI makes raw discovery cheaper and human-verified impact the thing platforms are actually willing to pay for.

Source: GitHub Security Blog; The Hacker News.