Next chapter: Restructuring GitHub’s bug bounty program

The security research community makes GitHub safer for everyone. That’s the simple idea behind our bug bounty program. For more than a decade, researchers from around the world have helped us find and fix vulnerabilities before they could be exploited, and we’ve worked hard to be a program worth their time. Today, we’re sharing some meaningful changes to how the program works. These decisions comes after months of reflecting on our program, analyzing what’s happening across the industry, and thinking about researcher experience. What’s changed and why The program is facing an increasing queue. We have already made adjustments to accommodate the rise in new researchers and the acceleration in efforts of researchers we’ve been working with. We shared these changes in a recent blog post . These changes are about two things: reducing the noise so we can focus on the signal, and building a program that serious researchers find rewarding to participate in. Introducing a permanent VIP program We’re formalizing a permanent private/invite-only VIP program for qualified researchers who consistently deliver high-quality, high-impact work. VIP researchers get higher payouts, faster response times, and a closer working relationship with our security engineering team. The goal is to create a space where the researchers who invest deeply in understanding GitHub can work with us directly and get an experience that reflects the effort they put in. VIP program bounty table: Severity Payout Low $1,000 Medium $7,500 High $20,000 Critical $30,000+ How to qualify : We’ll publish clear criteria on our public HackerOne page . The path in is built around demonstrated, consistent quality. To qualify, you must accomplish at lea st one of the following: One critical finding Two high findings Four medium findings Seven low findings The core shift here is in what we’re incentivizing: you don’t earn more by submitting more. You earn more by submitting better. A restructured public bounty table To