GitHub halves public bug bounty payouts.

Transcript

GitHub's public bug bounty pays a lot less starting today. A critical vulnerability is now worth a flat ten thousand dollars. Last week that same bug could pay twenty to thirty thousand or more. Every severity level gets cut by at least half. The money didn't vanish though. It moved to an invite only tier called VIP, where critical findings still pay thirty thousand plus. To get in, you need one critical find, or two highs, or four mediums. GitHub says the reason is its triage queue drowning in low effort and AI generated reports. Filing a fake bug is nearly free. Reading one costs a human twenty minutes. So GitHub priced the filter instead of policing it. The people who lose here aren't the stars. It's the steady researcher finding two mediums a year who now gets a flat rate.