Do Son 
The Microsoft-owned code repository, GitHub, recently published a blog post announcing a sweeping overhaul of its security initiatives. This transformation primarily abandons the previous floating reward ranges. Instead, it implements a fixed payment structure based on vulnerability severity assessments. Concurrently, GitHub introduced an exclusive VIP initiative. Security researchers invited to this elite echelon will witness their bounty payouts instantly quadruple.
Public Bounty Rewards Face Substantial Reductions
Under the revised framework, GitHub’s public bug bounty initiative completely discards its prior flexible ranges. The platform now issues fixed compensation determined strictly by severity classifications. Unfortunately, this paradigm drastically reduces the baseline reward amounts. However, this strategy functions as a potent incentive for security researchers to submit high-quality vulnerabilities. Consistently reporting exceptional flaws may ultimately secure a coveted VIP promotion.
Updated Public Reward Structure
- Low Severity: $250 (Previously a floating range of $617 to $2,000)
- Medium Severity: $2,000 (Previously $4,000 to $10,000)
- High Severity: $5,000 (Previously $10,000 to $20,000)
- Critical Severity: $10,000 (Previously $20,000 to $30,000)
GitHub asserts that fixed payouts significantly diminish financial uncertainty between security researchers and the vulnerability triage team. Previously, internal security teams evaluated the specific bounty amounts subjectively. Therefore, researchers occasionally felt undercompensated while triage teams deemed the vulnerabilities less impactful. Furthermore, this systemic alteration effectively minimizes administrative processing overhead. Teams no longer need to expend valuable time meticulously calculating appropriate reward figures.
VIP Promotion Quadruples Bounty Payouts
Simultaneously, GitHub officially launched a permanent, invitation-only VIP bug bounty program. Rewards for VIP researchers demonstrably exceed those offered in the standard public tier. Financially, the VIP payouts roughly equate to the median or upper limits of the former floating ranges. Consequently, security researchers invited to the VIP tier might secure payouts similar to or exceeding their previous earnings.
Exclusive VIP Reward Structure
- Low Severity: $1,000 (VIP Program)
- Medium Severity: $7,500 (VIP Program)
- High Severity: $20,000 (VIP Program)
- Critical Severity: $30,000 or more (VIP Program)
Preliminary qualification requirements for VIP researchers include specific submission milestones. A candidate must submit at least one critical vulnerability, two high-severity flaws, four medium-severity issues, or seven low-severity bugs. GitHub will subsequently publish comprehensive VIP evaluation criteria in complete detail. Nevertheless, the platform has not yet disclosed the required timeframe for achieving these submissions. Moreover, meeting these baseline thresholds does not absolutely guarantee an exclusive invitation.
AI Disruption Drives Program Reforms
The profound impact of artificial intelligence primarily necessitated these robust program adjustments. Bug bounty platforms currently face an escalating deluge of low-quality reports. Specifically, AI-assisted submissions generate numerous superficial and invalid vulnerability candidates.
GitHub stated that the public program will aggressively implement strict HackerOne signal requirements. Security researchers failing to meet this standard will receive limited submission opportunities to establish their professional credibility.
GitHub emphasizes that this policy does not intentionally deter novice security researchers. Instead, it ensures the program remains operationally viable and highly efficient. Put simply, submitting invalid vulnerability reports repeatedly may result in losing submission privileges entirely. HackerOne typically grants new researchers a maximum of four submission attempts per project. GitHub firmly believes this allowance provides ample opportunity for genuinely talented newcomers to prove their analytical capabilities.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
