GitHub announces restructuring of its bug bounty program

GitHub announced a comprehensive overhaul of its bug bounty program on its security blog, outlining a new tiered reward structure, expanded scope of eligible assets, and revised reporting guidelines. The changes introduce higher payouts for critical vulnerabilities, add previously excluded services such as GitHub Actions and Codespaces to the program, and launch a private bounty track for vetted researchers. The updated policy also clarifies eligibility criteria, streamlines triage procedures, and provides clearer timelines for disclosure and remediation, aiming to align the program with industry best practices and encourage broader participation from the security community.

The announcement generated discussion on Hacker News, where the post received 16 points and eight comments, reflecting interest from developers and security researchers. Analysts note that the restructuring addresses feedback about limited coverage and reward levels in the prior program, and the inclusion of private bounties suggests a strategic move to engage high‑skill participants. GitHub expects the revised framework to enhance the detection and mitigation of security flaws across its platform, thereby strengthening overall ecosystem resilience.