GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier

GitHub is reducing public bug bounty payouts by at least half for all severity levels starting July 27, 2026. Critical findings will have a fixed payout of $10,000, down from the previous range of $20,000 to $30,000 or more. In contrast, the company's invite-only VIP tier will offer payouts of $30,000 or more. Reports submitted before the change takes effect will be eligible for the previous payout terms. This change applies to new reports, but those already in the triage queue will also retain the old payout terms if they were filed before the deadline. GitHub's VIP tier will now be the only way to receive the higher payouts.