GitHub Revamps Bug Bounty Program Amid AI Report Surge

GitHub is overhauling its bug bounty program effective July 27, 2026, to address a surge in low-quality submissions, particularly those generated by AI. The new structure introduces a two-tier system: a public program with significantly reduced payouts and an invite-only VIP tier for seasoned researchers. Public submissions will see rewards cut from as much as $30,000 for critical vulnerabilities to a maximum of $10,000. The VIP tier offers higher payouts, with critical vulnerabilities earning at least $30,000. GitHub aims to reduce administrative noise and focus on quality submissions. New researchers will face limits on report submissions until they demonstrate a history of valid findings. The changes follow earlier adjustments aimed at improving report quality and managing the influx of AI-assisted submissions.

Key Points: • GitHub's bug bounty payouts are significantly reduced for public submissions. • A new VIP tier rewards seasoned researchers with higher payouts. • Newcomers face limits on report submissions until they prove their capability.