Overview
- GitHub announced the overhaul on July 22 and will apply the new rules to reports submitted on or after July 27, 2026 while honoring earlier submissions under the old terms.
- The company formalized a permanent invite-only VIP tier that offers faster response, closer collaboration with GitHub’s security engineers, and higher fixed payouts starting at $1,000 for low up to $30,000+ for critical findings.
- The public program moves from flexible ranges to static payouts of $250 (low), $2,000 (medium), $5,000 (high) and $10,000 (critical) and retains discretionary bonuses for exceptional work.
- GitHub will require a HackerOne signal threshold on the public program to limit low-effort and AI-assisted reports and will allow newcomers a small number of initial submissions while they build a track record.
- The change responds to a wider 2026 surge in automated and low-signal reports seen by maintainers such as curl and others and aims to speed remediation and reward deeper product-specific research while raising concerns that access and diversity among researchers may narrow.