4 hours ago
- GitHub's bug bounty program is introducing a permanent VIP program for researchers who consistently deliver high-quality work, with higher payouts and faster response times.
- The public bounty program is being restructured to static payouts per severity level, reducing uncertainty and overhead.
- A signal requirement is being implemented on the public program to reduce low-effort and AI-generated reports, allowing initial submissions for newcomers.
- The program aims to incentivize quality over quantity, with a focus on deeper relationships and better findings.
- Existing reports submitted before July 27, 2026 will be honored under the previous bounty structure.
- GitHub is investing in faster response times, clearer severity reasoning, and more community engagement at conferences.