Next chapter: Restructuring GitHub’s bug bounty program

GitHub announced significant changes to its bug bounty program, aiming to enhance the experience for security researchers who help identify vulnerabilities. The updates follow months of analysis and industry benchmarking, addressing an increasing backlog of reports. Key adjustments include a permanent private VIP program for top contributors, offering higher rewards and closer collaboration with GitHub’s security team. The program will also introduce clearer, static payouts per severity level instead of variable ranges to reduce uncertainty for researchers.

To reduce low-effort submissions, GitHub will implement a signal requirement on its public program via HackerOne, allowing newcomers up to four initial submissions to establish a track record. Reports submitted before July 27, 2026, will retain the previous bounty structure, with grandfathering applied to existing backlogs. The changes reflect a broader shift toward rewarding meaningful research over sheer volume, while maintaining accessibility for new researchers.

GitHub emphasized its commitment to treating researchers as partners, with plans to improve response times, severity reasoning, and community engagement. The company will continue to participate in security conferences like DEFCON and engage directly with the research community. These efforts align with a broader initiative to build stronger, more transparent relationships with security researchers.

The restructuring also includes updates to prioritize quality submissions, clarify shared responsibility boundaries, and evolve reward structures for low-risk findings. GitHub highlighted its ongoing investments in repository ownership validation and secret scanning workflows, demonstrating a holistic approach to improving platform security and researcher collaboration.