GitHub Tightens Bug Bounty Rules as AI Changes Security Research

GitHub has announced a major overhaul of its bug bounty programme, introducing an invite-only VIP tier for top security researchers while lowering payouts in its public programme to focus on higher-quality vulnerability reports.

The changes will take effect from July 27, 2026.

The Microsoft-owned platform said the update comes after months of reviewing its bug bounty programme, which has seen a growing number of submissions, including an increase in low-quality and AI-generated reports.

As part of the restructuring, GitHub is launching a permanent private VIP programme for researchers who consistently report high-impact security vulnerabilities. They will receive higher rewards, faster response times, and closer collaboration with GitHub’s security engineering team.

Under the new VIP payout structure, researchers can earn $1,000 for low-severity bugs, $7,500 for medium-severity issues, $20,000 for high-severity vulnerabilities, and over $30,000 for critical findings.

To qualify, they must demonstrate a strong track record by reporting one critical bug, two high-severity bugs, four medium-severity bugs, or seven low-severity bugs.

“The core shift here is in what we’re incentivising: you don’t earn more by submitting more. You earn more by submitting better,” GitHub said in the blog post.

The company has also revised payouts for its public bug bounty programme. Instead of offering payout ranges, it will now use fixed rewards to make compensation more predictable.

Under the updated public programme, researchers will receive $250 for low-severity reports, $2,000 for medium, $5,000 for high, and $10,000 for critical vulnerabilities.

GitHub said the public programme will continue to serve as an entry point for researchers who may eventually qualify for the VIP tier.

To reduce spam and AI-generated submissions, the company is also introducing a HackerOne signal requirement. New researchers who do not yet meet the platform’s trust threshold will initially be limited to four submissions while building their reputation.

The company added that the measure is intended to improve report quality rather than discourage newcomers.

The reports submitted before July 27 will continue to be evaluated under the existing payout structure. Looking ahead, the company will continue investing in faster response times, clearer communication, stronger engagement with the security research community, and improved collaboration through industry events such as DEF CON.