GitHub restructures its bug bounty program, making its invitation-only VIP program permanent to curb low-quality and AI-generated reports.
On July 22, 2026, GitHub announced a restructuring of its 'GitHub Bug Bounty Program,' which rewards discoverers of vulnerabilities. The restructuring is being done in response to an increase in low-quality reports and AI-generated reports, and will focus on creating a system that prioritizes the quality of reports.
Next chapter: Restructuring GitHub's bug bounty program - The GitHub Blog
https://github.blog/security/next-chapter-restructuring-githubs-bug-bounty-program/
The bug bounty program is a system that encourages external security researchers to find problems and pays rewards for valid reports. For over 10 years, GitHub has used information from researchers around the world to improve the security of its services.
Meanwhile, the number of reports that GitHub's security team has to review continues to grow. If a large number of low-quality or AI-generated reports arrive, truly critical vulnerability reports could get buried in the backlog. GitHub had been adjusting its reporting system for some time, but has now decided that it needs to change its system to prioritize the quality of reports rather than the sheer volume of reports.
One permanent measure being implemented is the invitation-only 'VIP Program.' Researchers who consistently submit high-quality reports and meet the participation requirements will receive higher-than-usual rewards, faster responses, and easier access to GitHub's security team. VIP program participants will receive the following rewards depending on the severity of the vulnerability:
| severity | Bonus |
|---|---|
| low | $1,000 (approximately 160,000 yen) |
| Medium | $7,500 (approximately 1.2 million yen) |
| high | $20,000 (approximately 3.3 million yen) |
| serious | $30,000+ (approximately 4.9 million yen or more) |
Eligibility for the VIP program is obtained by achieving one critical vulnerability, two high-level vulnerabilities, four medium-level vulnerabilities, or seven low-level vulnerabilities. Detailed requirements will be announced on HackerOne's public GitHub page.
The public program will continue, but the rewards will be changed to a fixed amount based on the severity of the vulnerability. This will make it easier for researchers to predict their rewards by clearly defining the amount, and will also reduce the assessment work on GitHub's end.
| severity | Bonus |
|---|---|
| low | $250 (approximately 40,000 yen) |
| Medium | $2,000 (approximately 330,000 yen) |
| high | $5,000 (approximately 820,000 yen) |
| serious | $10,000 (approximately 1.6 million yen) |
Furthermore, HackerOne's 'Signal Requirements' will be introduced, which limit the number of submissions based on reporting history over the past 365 days. Researchers who do not meet the criteria can still submit up to four reports, so this is not a system that automatically excludes new participants.
The new system will apply to reports submitted on or after July 27, 2026. GitHub states that it aims to create a program that prioritizes the quality of investigations over the number of reports, and appropriately rewards researchers who discover critical vulnerabilities.
Related Posts:
in Security, Posted by log1d_ts