Restructuring GitHub's bug bounty program

GitHub says it is overhauling its bug bounty program — the system where outside researchers get paid for finding security flaws — because the queue is clogged with low-effort and AI-written reports. The big twist? A permanent invite-only VIP tier will now get higher payouts, faster replies, and closer access to GitHub’s security team, while the public program moves to lower, fixed rewards and a new submission limit for people without enough platform reputation. In plain English: GitHub wants fewer reports, but better ones.

And wow, the comment section heard "fewer reports" and translated it to "cool, so outsiders get paid less for the same problem?" That was the main explosion. One user bluntly argued that if the “wrong” person finds a serious flaw, the reward is capped at a much lower amount — which, critics say, could make people think twice before reporting it at all. Another didn’t even bother with subtlety, calling the whole thing a straight-up insult to non-VIPs. The hottest backlash centered on fairness: if a real security hole is real no matter who finds it, why should status change the payout?

There was also some classic internet side-eye and brainstorming. One commenter wondered whether this will just encourage researchers to form mini-cliques that self-vet each other to farm reputation and get into the velvet-rope club. Another dropped a jaw-on-the-floor comparison to unequal treatment based on identity, which instantly cranked the drama to eleven. Even the dry little "Dupe" comment had the vibe of someone arriving just to toss a match on the discourse bonfire. GitHub says it’s cutting noise and rewarding quality; a loud chunk of the crowd says it looks a lot more like gatekeeping with a payout haircut.