GitHub slashes public bug bounty payouts as AI report flood buries its security team

Starting July 27, 2026, GitHub cuts public bug bounty payouts by at least half, with critical findings dropping to a fixed $10,000. A new invite-only VIP tier pays $30,000 or more for critical vulnerabilities. The changes aim to reduce noise from AI-generated reports while rewarding established researchers with higher pay and faster responses.