GitHub Elevates Bug Bounty Program Standards for Quality Submissions

GitHub is refining its bug bounty program to address the evolving landscape of security research and submission volume. The updated standards, effective May 15, 2026, will place a stronger emphasis on the quality of vulnerability reports. Submissions will now be evaluated more strictly, requiring a working proof of concept that clearly demonstrates the security impact of the reported issue. This move is intended to filter out theoretical attack scenarios or findings already covered by GitHub's ineligible list, which have contributed to a significant increase in submission volume over the past year. The company acknowledges that new tools, including AI, have lowered the barrier to entry for security research, leading to both positive developments and a surge in reports without real security impact. GitHub explicitly welcomes the use of AI in security research, viewing it as a force multiplier, but reiterates that AI-assisted findings must still be verified, reproduced, and submitted with a working proof of concept to be considered valid. Unvalidated outputs from AI tools, submitted without reproduction or demonstrated impact, will not meet the new criteria. Furthermore, GitHub is clarifying its shared responsibility model. While GitHub invests heavily in systems and teams to detect and handle malicious content, users are also responsible for exercising judgment regarding the repositories, issues, and code they interact with. This includes reviewing content before execution. The program updates aim for faster triage, clearer communication, and ensuring that valid findings receive the appropriate attention and compensation, ultimately making GitHub's platform safer for its over 180 million developers.