GitHub revamps bug bounty program

July 23, 2026

Effective July 27, 2026: permanent invite-only VIP program; public static payouts reduced; HackerOne signal requirement (up to four initial submissions for newcomers). Backlog grandfathered. Framed as reducing low-effort/AI-generated reports while rewarding deeper research.