GitHub Cuts Public Bug Bounty Payouts by Half to Prioritize Top Researchers

SAN FRANCISCO — GitHub announced a significant restructuring of its bug bounty program effective July 27, 2026, reducing public payouts for reported vulnerabilities by at least half while introducing an exclusive tier designed to reward elite security researchers. The move marks a sharp departure from the platform's previous open-access model, signaling a strategic shift toward concentrating resources on established experts.

Starting next week, standard rewards available to the general community of bug hunters will be slashed, with many categories seeing reductions exceeding 50%. In parallel, GitHub is launching a new VIP tier intended for critical vulnerabilities. Researchers who qualify for this status will receive higher financial compensation than previously possible under the old system, alongside faster response times and direct access to the company's security engineering team.

The technology giant stated that the changes are necessary to reduce noise in its reporting pipeline and ensure that high-severity issues are addressed more efficiently. By limiting broad participation for lower-tier rewards, GitHub aims to streamline communication channels and provide established researchers with closer collaboration opportunities. The new structure is designed to incentivize quality over quantity, rewarding those who consistently identify complex security flaws.

Under the previous framework, any researcher could submit a report and receive standardized payouts based on severity levels. Critics of such open models have long argued that high volumes of low-quality reports can overwhelm engineering teams, delaying fixes for genuine threats. GitHub's new approach attempts to solve this by creating a tiered ecosystem where top performers are fast-tracked while the baseline reward pool is tightened.

The announcement comes as cybersecurity firms increasingly grapple with resource allocation in an era of sophisticated attacks. While the VIP program offers lucrative opportunities for elite hackers, the reduction in public payouts has raised questions about the impact on emerging talent and smaller security researchers who rely on these bounties for income. The company did not specify exact criteria for entering the new VIP tier beyond a history of high-impact discoveries.

Industry observers note that while the financial incentives for top-tier work are increasing, the barrier to entry for meaningful participation has risen significantly. It remains unclear how many researchers will successfully transition into the new elite category or whether the reduction in public rewards will deter potential discoverers from reporting issues altogether. GitHub declined to provide immediate projections on how these changes might affect the overall volume of vulnerability reports received over the coming months.