GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier

Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more. Reports filed before that date, including those already in GitHub's growing triage queue, will retain the previous payout terms. GitHub said the

The article reports that GitHub is cutting public bug bounty payouts by roughly half across all severities starting July 27, 2026, moving to fixed rewards (e.g., critical: $10,000) while concentrating top payments ($30,000+) in a permanent invite-only VIP tier for high-performing researchers.[1][2][3][5] GitHub explicitly links these changes to increased low-quality and AI-generated reports, adding stricter participation requirements (HackerOne signal) to reduce noise and focus on higher-impact, product-specific vulnerability research.[1][4][5] From a RealGround perspective, this restructuring is a supply-chain security signal: a major platform is tightening incentives and access controls around vulnerability discovery, partly in response to commoditized, AI-assisted scanning, which affects how organizations should plan their own bounty programs and dependency risk management. Practically, customers relying on GitHub in their software supply chain should review how reduced public payouts and higher VIP incentives may shift research attention, and consider complementary measures such as targeted red teaming and supply-chain security governance to avoid gaps in coverage.