GitHub introduces fixed bug bounty rewards and elite VIP programme

GitHub has announced significant changes to its bug bounty program, transitioning from a flexible payment structure to fixed compensation based on severity assessments. This change aims to reduce compensation disparities and administrative overhead. The new public reward system offers:

• Low Severity: $250
• Medium Severity: $2,000
• High Severity: $5,000
• Critical Severity: $10,000.

Additionally, a new VIP program has been introduced for elite security researchers, providing substantially higher rewards:

• Low Severity: $1,000
• Medium Severity: $7,500
• High Severity: $20,000
• Critical Severity: $30,000 or more.

Researchers must meet specific submission milestones to qualify for the VIP program. GitHub's reforms are also driven by challenges related to AI-generated low-quality reports, necessitating stricter submission criteria.