GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier

GitHub is cutting public bug bounty payouts across all severity levels and moving from flexible ranges to fixed payments (e.g., critical public rewards reduced to $10,000), while maintaining a higher invite-only VIP tier; the change, coupled with stricter submission requirements, aims to reduce noisy AI-generated reports and prioritize trusted researchers. The report also discusses how AI (e.g., Google's Gemini 3.5 Flash Cyber) is increasing the volume of candidate findings, how maintainers like curl have adjusted bounty programs, and the trade-offs between automated discovery and the need for validated, product-specific impact.