GitHub Reduces Bug Bounty Payments Starting July 2026

Starting July 27, 2026, GitHub will reduce payments for public bug bounty programs by at least 50%. This affects all severity levels of security vulnerabilities. Critical reports, which previously ranged from $20,000 to $30,000, will be reduced to a fixed amount of $10,000. Additionally, GitHub will introduce a new, permanent VIP program that will be accessible by invitation only.

Participants in this program can expect payments of $30,000 or more, depending on the severity of the reported security vulnerabilities. This measure aims to increase incentives for security researchers to focus on serious security issues. Reports submitted before the deadline, including those already in GitHub's queue, will retain the previous payout conditions. This means that researchers reporting vulnerabilities before July 27 will be eligible for the higher amounts.

GitHub has deemed this decision necessary to ensure the sustainability of the bug bounty program. The platform is facing an increase in reports, highlighting the need for an adjustment in financial incentives to maintain the quality and effectiveness of the program. The changes come at a time when cyberattacks and security threats are on the rise globally. According to the Cybersecurity & Infrastructure Security Agency (CISA) report from 2025, there was a 30% increase in reported security incidents compared to the previous year. GitHub has previously offered high rewards to security researchers to encourage the discovery and reporting of vulnerabilities.

However, the new structure may lead some researchers to have less incentive to invest their time and resources in searching for vulnerabilities. The platform has emphasized that the changes are not intended to compromise the quality of security research. Instead, it is expected that VIP invitations will be awarded to the most active and successful researchers to attract the best talent. The adjustments to bug bounty payments are part of a broader strategy by GitHub aimed at improving the platform's security posture.

In recent years, GitHub has made significant investments in security measures to ensure the integrity of software development. The new policies will take effect on July 27, 2026, and could have far-reaching implications for security research and the relationship between GitHub and the security community. GitHub has announced that further details regarding the criteria for the VIP program and the selection process will be released in the coming weeks.