GITHUB has announced significant changes to its bug bounty program, transitioning from a flexible payment structure to fixed compensation based on severity assessments. This change aims to reduce compensation disparities and administrative overhead. The new public reward system offers:
- Low Severity: $250
- Medium Severity: $2,000
- High Severity: $5,000
- Critical Severity: $10,000.
Additionally, a new VIP program has been introduced for elite security researchers, providing substantially higher rewards:
- Low Severity: $1,000
- Medium Severity: $7,500
- High Severity: $20,000
- Critical Severity: $30,000 or more.
Researchers must meet specific submission milestones to qualify for the VIP program. GitHub's reforms are also driven by challenges related to AI-generated low-quality reports, necessitating stricter submission criteria.