GitHub slashes public bug bounty payouts as AI report flood buries its security team

GitHub has decided that, if everyone with an AI chatbot can file a bug bounty report, it may as well stop paying them like seasoned security researchers. Starting July 27, the Microsoft-owned code forge is overhauling its bug bounty program with a two-tier system that cuts rewards for public submissions while dangling much fatter payouts to a new invite-only group of researchers with proven track records. At the same time, newcomers will find themselves capped on how many reports they can submit until they've demonstrated they can produce something worth reading. The Microsoft-owned biz says that the shake-up is a response to the flood of low-effort and AI-generated reports now accompanying many bug bounty programs. Rather than paying more people to file more reports, GitHub wants to spend more on researchers who've proved they can find the real thing. Cathering Cassell, product security engineer at GitHub. These changes are about two things: reducing the noise so we can focus on the signal, and building a program that serious researchers find rewarding to participate in." For researchers sticking with the public program, a low-severity finding that previously earned between $500 and $1,000 will now bring in $250. Medium bugs top out at $2,000 instead of $5,000, high-severity flaws have been cut from as much as $20,000 to $5,000, and the maximum reward for a critical vulnerability falls from $30,000 to $10,000. The highest rewards are now reserved for GitHub's new invite-only VIP program. There, low-severity findings are worth $1,000, medium bugs $7,500, high-severity issues $20,000, and critical vulnerabilities at least $30,000. Entry isn't open to everyone. GitHub says invitations will be based on a proven history of valid reports, with researchers needing anything from one accepted critical vuln to seven accepted low-severity findings to qualify. GitHubb is also enabling HackerOne's "signal requirement," limiting how many reports new researchers can submit before they've established a history of legitimate findings. It says genuine newcomers will still have up to four opportunities to prove themselves, while reports already sitting in the backlog will continue to be assessed under the previous payout structure. The overhaul follows changes GitHub introduced earlier this year that tightened report-quality requirements and warned researchers against flooding the platform with AI-assisted submissions. GitHub is betting that fewer reports, from researchers with a proven track record, will do more for security than an ever-growing pile of AI-assisted submissions waiting for someone to read them. (R)