GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
Summary
GitHub is significantly reducing its public bug bounty payouts, with critical findings dropping from over $20,000 to a fixed $10,000 starting July 27, 2026. The company is also moving its top rewards to an exclusive, invite-only VIP tier, which will offer payments of $30,000 or more.
IFF Assessment
FOE
The reduction in bug bounty payouts may disincentivize some researchers from reporting vulnerabilities, potentially leaving more flaws undiscovered.
Defender Context
This change by GitHub could impact the ecosystem of security researchers willing to find and report bugs. Defenders should be aware that fewer publicly reported vulnerabilities might be found through traditional bounty programs, potentially shifting focus to private disclosures or internal testing.