Microsoft-owned code hosting platform GitHub has decided to make major changes to its bug bounty program as the popularity of AI chatbots has triggered a "flood" of low-quality and AI-generated reports. Starting from July 27, GitHub will officially implement a new "dual-track" reward mechanism: significantly reducing the bug bounty submitted to the public, while leaving the highest reward to an elite team of security researchers with outstanding records selected through an invitation system.
In addition, for new researchers, the platform will also limit the number of report submissions until they can prove their ability to submit high-quality reports.
According to the adjusted rules, in the public bounty program, the reward for low-risk vulnerabilities has been reduced from the original $500 to $1,000 to $250; the upper limit for medium-risk vulnerabilities has been reduced from $5,000 to $2,000; the reward for high-risk vulnerabilities has been reduced from a maximum of $20,000 to $5,000; and the maximum reward for serious vulnerabilities has been significantly reduced from $30,000 to $10,000.
The opposite is the new VIP invitation-only plan. Under the program, researchers can earn $1,000 for finding low-severity vulnerabilities, $7,500 for medium-severity vulnerabilities, $20,000 for high-severity vulnerabilities, and bounties for critical vulnerabilities start at least $30,000. Entry requirements are extremely strict and researchers need to have a good history of valid reporting - for example, having confirmed 1 critical vulnerability or up to 7 low-severity vulnerabilities.
At the same time, GitHub has also enabled HackerOne's "semaphore limit" mechanism. New researchers will be limited in the number of submissions before they can establish a good and effective reporting record (beginners have up to 4 opportunities to prove themselves). GitHub's product security engineer said that the core purpose of this change is to "reduce noise, focus on effective signals" and provide more valuable returns to truly outstanding researchers. Reports previously in the backlog will continue to be evaluated according to the original payment criteria.