GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier

Summary: GitHub will cut public bug bounty payouts by at least half at every severity level starting July 27, 2026, dropping critical findings from $20,000-$30,000+ to a fixed $10,000 while its invite-only VIP tier pays $30,000 or more for critical vulnerabilities. The Hacker News calculated the new public rates are 50% lower for medium, high, and critical findings and about 59% lower for low-severity reports against the bottom of GitHub's previous ranges, with reports filed before that date retaining the old terms.
Why it matters: GitHub's own table now prices a critical public finding at $10,000 against $30,000 or more inside the VIP tier, and entry to that tier requires at least one critical, two high, four medium, or seven low-severity reports with no stated time window. The restructuring follows curl ending its cash bounty in January 2026 after confirmed vulnerabilities fell below 5% amid AI-generated junk reports, and the invite-only structure concentrates GitHub's closest researcher relationships among people who have already succeeded inside the program.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026