- GitHub Launches Two-Tier (Public and Private) Bug Bounty Schemes from July 27, 2026
- Change comes in response to increase in lower quality, AI-generated reports
- VIP researchers will earn about 3-4 times more per report
GitHub has confirmed plans to evolve its bug bounty program into a two-tier system, effective for reports submitted on or after July 27, 2026.
Under the new arrangement, the Microsoft-owned coding platform will add a lower-paying public program available to the wider research community under a higher-paying invitation-only program.
Product security engineer Catherine Cassell explained that the change comes in response to a growing backlog of low-effort, low-quality, AI-generated reports.
Latest videos fromTechRadar
GitHub complains about AI-generated bug reports
For the new public program, GitHub will replace payout intervals with a single payment for each difficulty level spanning $250, $2,000, $5,000, and $10,000 for low, medium, high, and critical. Cassell said this would help researchers know in advance what a valid find might be worth, and would also give insiders less of the headache of having to decide where a report sits within a range.
Notably, the payouts are much lower than before, where the previous ranges paid out $500-$1,000, $2,000-$5,000, $5,000-$20,000 and $10,000-$30,000.
Invited VIP researchers under the second plan will earn about 3-4 times more than researchers under the second scheme, depending on the severity of the bug.
GitHub is also adding a HackerOne signal requirement for new researchers, giving them four opportunities to “establish a track record” — likely another response to increasing AI-generated reports, which are typically of lower value.
“We want to build a program that attracts the research we value, creates an experience that reflects how seriously we take this work, and maintains the trust researchers place in us every time they submit a report,” Cassell concluded.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds.
