Overview
- GitHub announced on Wednesday that it will create a permanent invite-only VIP tier that offers faster response and higher fixed payouts of $1,000 for low, $7,500 for medium, $20,000 for high, and $30,000 or more for critical findings.
- The public program will switch to static payouts of $250 low, $2,000 medium, $5,000 high, and $10,000 critical to reduce triage overhead and set clear expectations for researchers.
- GitHub will enforce a HackerOne signal requirement to limit low-effort or AI-generated submissions and will allow newcomers up to four initial reports to establish a track record on the platform.
- Reports submitted before July 27, 2026 will be processed under the old terms and GitHub says it will publish detailed VIP qualification criteria on its HackerOne page, which include thresholds such as one critical or two high findings.
- The change responds to rising submission volume and automated noise and could speed work with trusted researchers while raising barriers for new contributors, shifting how outside researchers earn top rewards and how GitHub triages vulnerabilities.