GitHub Slashes Public Bug Bounties, Adds VIP Tier Amid AI Flood

GitHub is repricing its public bug bounty around the reality that a lot of the inbound is now machine-written. According to The Register, from July 27 the public program will pay $250 for a low, $2,000 for a medium, $5,000 for a high, and $10,000 for a critical. Those last two numbers used to be $20,000 and $30,000, so the top end of what a public submitter can earn is being cut by roughly two-thirds.

The money has not disappeared. It has moved into a permanent invite-only VIP tier that keeps the older shape of the payout table, with critical findings starting at $30,000, high at $20,000, medium at $7,500, and low at $1,000. Entry is gated by a track record on the program, with GitHub citing accepted findings such as one critical or seven lows as the kind of history that qualifies a researcher. The company frames the goal, in a quote reported by The Register from product security engineer Catherine Cassell, as being about "reducing the noise so we can focus on the signal, and building a program that serious researchers find rewarding to participate in."

Alongside the payout change, GitHub is adopting HackerOne's signal requirement for the public program, which caps newcomers below the signal threshold at up to four initial submissions before they have to establish a track record. The stated driver is the flood of low-effort and AI-generated reports that has been burying the security team, a pattern other maintainers have been complaining about all year. The Register notes the same platform recently saw curl's Daniel Stenberg walk away from cash rewards in January over an AI-generated junk report problem, then return after the mix improved.

The honest caveat is that this is GitHub's framing of its own economics, and the reporting does not give hard numbers on how much AI-generated volume the team is actually seeing, nor on how a public researcher is supposed to graduate into the VIP tier in practice. It is also fair to ask whether $10,000 for a critical against a platform this central to the software supply chain will keep serious hunters interested, or push them toward buyers who pay more and ask fewer questions.

The forward-looking bet is that other large programs on HackerOne watch this closely and copy it. If GitHub's two-tier split holds up, the near-term winners are vetted researchers with a real GitHub history and vendors selling triage tools that can pre-filter AI-written reports before a human ever opens them.