GitHub plans a two-tier bug bounty program that cuts rewards for the public and boosts payouts for invite-only researchers, amid a flood of AI-generated reports
Code shack also putting new limits on first-time researchers, and reserving the biggest rewards for a hand-picked group of proven hunters
Context & Ripple Effects
GitHub previously broadened its bounty program by raising rewards and removing its maximum payout; the new structure reverses that openness for unproven reporters while concentrating incentives among vetted researchers. It also sits alongside GitHub's private vulnerability-reporting channel for open-source maintainers, which already emphasizes confidential handling of security findings.
The move follows a wider response to report volume: companies have been adding checks and AI-assisted triage to manage low-quality AI-generated vulnerability submissions. GitHub is now changing the economic incentives as well as the intake process.
First-order effects
- Public and first-time researchers face lower potential rewards and tighter participation limits, while GitHub's selected invite-only hunters receive larger incentives.
- GitHub can direct its highest bounty spend toward researchers it considers proven, reducing the value of low-confidence reports entering its public program.
Second-order effects
- Researchers who depend on public bounty access may shift effort toward programs with more open eligibility, while established hunters gain an advantage from access to higher-paying private tracks.
- Other bounty operators facing similar AI-generated-report volume may be pushed to combine automated triage with reputation, background-check, or invitation systems rather than rely on uniform public payouts.
Third-order effects
- If widely adopted, bug bounties could become less of an open discovery market and more of a tiered security-sourcing model, with track record and platform trust determining access to the best rewards.
- That may improve signal quality for operators, but it could also narrow the pool of researchers whose findings reach major platforms unless public disclosure routes remain usable.
The trend: AI-assisted report volume is pushing vulnerability-reward programs toward gated participation and reputation-based incentives.