GitHub Restructures Bug Bounty Program to Improve Researcher Experience
Restructuring GitHub's bug bounty program
We are making significant changes to the GitHub bug bounty program to better support the security research community. For over a decade, researchers have helped us find and fix vulnerabilities, and we are committed to being a program worth their time. Today, we are sharing meaningful updates designed to enhance how researchers work with our team and ensure a smoother collaboration experience.
The security research community makes GitHub safer for everyone.
- wxw
> We’re formalizing a permanent private/invite-only VIP program for qualified researchers who consistently deliver high-quality, high-impact work.
> VIP program bounty table:
Severity Payout
-------- --------
Low $1,000
Medium $7,500
High $20,000
Critical $30,000+
> We are adjusting our public program rates to accommodate this shift in focus towards quality of relationships and findings over quantity of reports. We are also updating to static payouts—a single, clear number per severity level, rather than a wide range.
> Our new public program bounty table:
Severity Payout
-------- -------
Low $250
Medium $2,000
High $5,000
Critical $10,000
> To reduce the volume of low-effort and AI-generated reports, we’re implementing a HackerOne signal requirement on the public program.
- dinkelberg
So if the "wrong" person finds a critical vulnerability in GitHub, the payout is capped at $10,000. Might reduce the likelihood of it being submitted to the bug bounty program.
- everfrustrated
Seems to me like the game theory here is un-credentialed reporters need to submit their reports through credentialed folks who will vet and take a cut on the way through.
Why take the lower offer by going directly.
That sounds like a win for everyone involved.
- saagarjha
I wonder if this incentivizes people to form groups that self-vet for quality submissions to enhance their reputation.
- darkamaul
I believe the changes here make a lot of sense because, most of the time, your best bugs are not your first ones
Anyone can point an LLM to a code base and ask to find a vulnerability - and the initial set of findings is going to be rather lame.
Encouraging researchers to stick to a target and to report 7 lows before getting in will probably make their contributions more valuable.