- GitHub to launch two-tier (public and private) bug bounty schemes starting July 27, 2026
- The change comes in response to the increase in lower quality reports generated by AI
- VIP investigators will earn 3 to 4 times more per report
GitHub has confirmed plans to evolve its bug bounty program to a two-tier system, which will go into effect for reports submitted on or after July 27, 2026.
Under the new scheme, the Microsoft-owned coding platform will add a lower-paying public program that will be available to the broader research community, under a higher-paying invitation-only program.
Product security engineer Catherine Cassell explained that the change comes in response to a growing backlog of low-quality, low-effort AI-generated reports.
Latest videos ofTechnologyRadar
GitHub complains about AI-generated bug reports
For the new public program, GitHub will replace the pay ranges with a single payout for each severity, spanning $250, $2,000, $5,000, and $10,000 for low, medium, high, and critical. Cassell said this would help researchers know in advance how much a valid finding might be worth, and would also give experts less of a headache having to decide where a report falls within a range.
Notably, the payouts are much lower than before, with the above ranges paying between $500 and $1,000, between $2,000 and $5,000, between $5,000 and $20,000, and between $10,000 and $30,000.
VIP researchers invited under the second plan will earn 3 to 4 times more than researchers under the other plan, depending on the severity of the error.
GitHub is also adding a HackerOne token requirement for new researchers, giving them four opportunities to “establish a track record,” likely another response to the rise of AI-generated reports, which are typically lower value.
“We want to create a program that engages the research we value, creates an experience that reflects how seriously we take this work, and maintains the trust that researchers place in us every time they submit a report,” Cassell concluded.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
