Overview
Bug bounty programs face rising volumes of low-effort and AI-generated reports lacking PoCs or real impact — prompting static payouts, signal gates, and VIP tiers for deep researchers.
Timeline
- 2026-07-22: github restructures HackerOne program effective July 27 (2026-07-23-github-bug-bounty-restructure-vip)
- 2026-05: GitHub raised submission standards (PoC/impact)
Key Players
Analysis
Public rate cuts + VIP upside reframes quality relationships. Fairness depends on backlog grandfathering and clear VIP criteria.