GitHub Halves Public Bug Bounty Payouts Today

A critical vulnerability in GitHub is worth $10,000 today. Last week it was worth $20,000 to $30,000 or more. The restructuring GitHub announced on July 22 takes effect on July 27, and it cuts published rewards at every severity level of the public program by at least half. The money did not disappear. It moved to a permanent invite-only tier called VIP, where a critical finding still pays $30,000 or more. Anything submitted before today keeps the old terms, including the reports already queued for triage.

GitHub is unusually direct about why. The program has run for more than a decade, and the volume of incoming reports has outgrown the team that reads them. Most of that new volume is not useful. It is low-effort submissions and, increasingly, output from language models pointed at a bounty page and told to find something. Every one of those still has to be opened, read, and closed by a human, which is exactly the cost the attacker of a bounty program does not pay and the defender does.

RelatedWordPress Core RCE flaws exploited to plant webshells

What exactly changed?

The public program is now a fixed schedule instead of a range. Low pays $250, medium $2,000, high $5,000, critical $10,000. There is no negotiating band and no upside for an exceptional writeup at a given severity. The VIP program, which is invite-only and permanent once granted, pays $1,000, $7,500, $20,000 and $30,000 or more across the same four levels.

Getting into VIP is a documented ladder rather than a favour. A researcher qualifies with one critical finding, or two high, or four medium, or seven low. Newcomers get up to four submissions before the signal thresholds start applying, which GitHub describes as enough runway for someone with a genuine first bug. The line the company keeps returning to is blunt: you do not earn more by submitting more, you earn more by submitting better.

Why is a bug bounty being repriced at all?

Bounty programs have always had an asymmetry. Filing a report is nearly free. Triaging one is not. That asymmetry was survivable when writing a plausible vulnerability report required actually understanding the software. It stopped being survivable when a model could read a repository, produce four paragraphs of confident prose about a race condition that is not there, and do it a thousand times an hour.

The result is a queue where the median item is worthless and the mean item still costs a security engineer twenty minutes. GitHub is not the first to feel this. Maintainers of curl have been publicly complaining about AI-written vulnerability reports for well over a year, and other large programs have quietly raised their bars. GitHub is simply the biggest name to respond by changing the price list rather than the intake form.

Look at the design and it is a reputation system wearing a payout schedule. The public program becomes the qualifying round, priced low enough that submitting slop at volume returns almost nothing. The VIP tier is where the real money and the direct access to security engineers live, and you can only reach it by having been right before. That converts an open market into a two-stage filter, and it prices the filter rather than policing it.

1. Jul 22GitHub publishes the restructuring new schedule and VIP criteria announced on the Security Blog
2. Jul 22–26Grandfather window reports filed in this period keep the old, higher payout terms
3. Jul 27New rates take effect public critical drops to a flat $10,000
4. Q4 2026First read on whether it worked watch report volume, triage latency, and whether serious researchers stay

Who actually loses money here?

Not the top of the distribution. A researcher who lands one critical bug in GitHub per year was already going to be invited into VIP, and after that invitation their critical findings pay the same $30,000 or more they did before. For them this is roughly neutral, with better response times attached.

The people who lose are in the middle. Someone who reliably finds two or three medium-severity issues a year, never quite clearing the four-medium bar, now earns $2,000 apiece instead of a negotiated range. That is a real pay cut for genuine, careful work whose only sin is being unspectacular. Regional economics matter here too. A flat $250 for a low finding reads differently to a researcher in Lagos or Dhaka than it does to one in San Francisco, and public bounty programs have historically been one of the few software income streams that ignored geography entirely.

Does this push bugs toward the grey market?

This is the question worth watching, and honest answer, nobody knows yet. Exploit brokers pay far more than $10,000 for a serious GitHub bug, and they always did, so the gap in absolute terms was already enormous. Bounty programs never competed on price. They competed on being legal, fast, low-friction and reputationally useful.

RelatedThe $15K/Month Job Offer That Shipped Malware in .git/hooks

What a halved public payout does is thin the reason to bother for the marginal finder, the one who was on the fence about spending a weekend on it. Some of that effort goes to other targets rather than to brokers. That is the more likely outcome, and from GitHub's perspective it may be an acceptable one, since a bug nobody looked for is not necessarily a bug that gets exploited. It is a bet, though, and it is being made against attackers who are also using models to find things faster.

Our take

The diagnosis is right and the remedy is defensible. A triage queue full of machine-written fiction is a genuine denial of service against a security team, and paying the same for noise as for signal was never going to hold. Two-tier structures are how most mature markets handle exactly this problem.

What sits badly is who absorbs the cost. GitHub's queue got worse because of an industry-wide shift in what it costs to generate plausible text, and the bill for that shift is being handed to the researchers who did nothing wrong, in the form of a flat rate half the old floor. The VIP tier makes that survivable for people who are already established. It does very little for the person whose first real bug arrives in year three.

There is also a quieter problem. Vulnerability research is one of the few security disciplines where the incentive to report has to beat the incentive to sit on a finding, and that margin has never been wide. Halving the public side of it while the offensive side gets cheaper to automate is a trade GitHub can probably afford. Smaller programs copying the schedule without GitHub's brand pull may find they cannot.

Original analysis by GenZTech. Payout figures taken directly from GitHub's Security Blog post, read July 27, 2026. Prior-range and context reporting via The Register.