Next Chapter: GitHub Overhauls Its Bug Bounty Program

GitHub has significantly overhauled its bug bounty program. The core shift is from 'quantity to quality,' formalizing a permanent VIP program for researchers who consistently submit high-quality vulnerabilities.

The VIP program operates on an invite-only basis, with reward levels of Low $1,000 / Medium $7,500 / High $20,000 / Critical $30,000+. Eligibility requires achieving at least one of the following: 1 Critical, 2 High, 4 Medium, or 7 Low.

Public program rewards have changed from the previous range-based structure to a single fixed amount: Low $250 / Medium $2,000 / High $5,000 / Critical $10,000. This decision was made because range-based rewards created uncertainty for researchers and increased internal processing burden.

In response to the rise in low-quality submissions such as AI-generated reports, a HackerOne Signal requirement is also being introduced. Researchers who fall below the threshold can submit only up to 4 reports initially, with the limit lifted once they build a track record. Submissions made before July 27, 2026 will be subject to the existing reward structure.