GitHub restructures bug bounty program following flood of AI-generated reports

GitHub now has a public and a private bug bounty scheme

by · TechRadar

News By Craig Hale Published 24 July 2026

(Image credit: N/A)

Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter

  • GitHub to launch two-tier (public and private) bug bounty schemes form July 27 2026
  • Change comes in response to rise in lower-quality, AI-generated reports
  • VIP researchers will earn around 3-4x more per report

GitHub has confirmed plans to evolve its bug bounty program into a two-tier system, which will come into force for reports submitted on or after July 27, 2026.

Under the new scheme, the Microsoft-owned coding platform will add a lower-paying public program that's available to the wider research community, under a higher-paying invitation-only program.

Product Security Engineer Catherine Cassell explained that the change comes in response to a growing backlog of low-effort, low-quality and AI-generated reports.

Latest Videos FromTechRadarWatch full video here:

GitHub complains about AI-generated bug reports

For the new public program, GitHub will replace payout ranges with a single payment for each severity, spanning $250, $2,000, $5,000 and $10,000 for low, medium, high and critical. Cassell said this would help researchers know in advance what a valid finding could be worth, and it would also give insiders less of a headache having to decide where a report sits within a range.

Notably, the payouts are much lower than before, with the previous ranges paying out $500-$1,000, $2,000-$5,000, $5,000-$20,000 and $10,000-$30,000.

Invited VIP researchers under the second plan will earn around 3-4x more than researchers under the other scheme, depending on bug severity.

GitHub is also adding a HackerOne signal requirement for new researchers, giving them four opportunities to "establish a track record" – likely another response to rising AI-generated reports, which are typically of lower value.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors