The record
Written from the 1 report below. Nothing here is unsourced.
- GitHub will cut its public bug bounty payouts by roughly half across all severity levels starting July 27, 2026, with critical findings dropping to a fixed $10,000, while boosting rewards for an invite-only VIP tier that pays $30,000 or more for critical bugs.
- The company attributes the change to growing noise from AI-generated reports and says it wants to reward better-quality submissions over higher volume.
- Reports filed before the cutoff date will keep the old payout terms.
- The shift reflects a wider industry trend, echoed by Google's new vulnerability-hunting AI model and curl's recent changes, where AI both floods triage queues with junk and speeds up capable researchers.
What to watch next
- Details on VIP qualification criteria and the undisclosed HackerOne Signal threshold GitHub says will appear on its program page
- Whether the four-report limit and fixed payouts deter new researchers or actually reduce junk submissions after July 27, 2026
- Whether other major bug bounty programs follow GitHub's shift toward invite-only tiers and lower public rewards
Coverage1
1 report
English national1
All filed from India
Named United States · curl · Daniel Stenberg · Gemini 3.5 Flash Cyber · GitHub · Google · HackerOne · OpenAI
The 1 report is listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.