GitHub Cuts Public Bug Bounty Payouts by Half July 27

Starting July 27, GitHub is cutting its public bug bounty payouts by at least half at every severity level. Critical findings — which previously paid between $20,000 and $30,000 or more — will carry a fixed $10,000 rate going forward. The top payouts, $30,000 and above, are moving exclusively to GitHub’s VIP tier: a permanent, invite-only program for the company’s most prolific and trusted researchers.

Reports already in the triage queue and those filed before the deadline retain the old terms. Everything submitted from July 27 onward falls under the new schedule.

The Hacker News reported the change Tuesday, noting that GitHub’s triage backlog is growing — which is relevant context, because triage capacity is one of the few levers a bug bounty program actually controls.

The mechanics are easy enough to understand. What they signal is worth sitting with.

Bug bounty programs have always been a strange market. Companies pay for work they couldn’t fully audit themselves; researchers take on risk and unpredictability in exchange for a shot at meaningful payouts. The public tier is where most of that uncertainty lives. You don’t know what the triage backlog looks like. You don’t know whether your report will be duplicated. You don’t know whether the program is actively watching your target surface at all. A growing queue is exactly the kind of friction that discourages the researcher who spent three weeks on a complex finding.

Cutting public payouts while raising the ceiling for an invite-only tier is one way to address that imbalance — or at least to reframe it. The VIP researchers presumably produce higher-signal reports, close faster, and require less overhead per finding. From a program operations standpoint, the segmentation is defensible. The top tier gets better money; the public tier gets a leaner schedule and, presumably, more focused triage attention.

The tradeoff sits with the independent researcher who built a practice on public bug bounty income. That path was never predictable, but the economics just shifted noticeably. A critical finding that once had a ceiling of $30,000 now has a fixed floor and ceiling of $10,000 — and the route to the higher tier is, by design, not transparent or open.

This isn’t the first time a major platform has restructured its payout model in a direction that concentrates rewards among established researchers while compressing the upside for everyone else. It probably won’t be the last. The question is whether the cut reduces overall report volume, improves average report quality, or both. GitHub is betting on the latter. The actual signal won’t be visible for a few months of triage data.

Researchers with work in progress have until July 27 to file under the current schedule.