So, researchers first need to collect some positive rep. But the rep points are global, so once you have fixed a few bugs for Google, you've gotten enough +rep that you can also receive stuff at GitHub.
Oh, and ID check when signing up at H1.
Long term all beg bounty submitters would be banned for pretty much all of tech.","title":null,"type":"comment","url":null},{"author":"applfanboysbgon","children":[{"author":"dfedbeef","children":[{"author":"applfanboysbgon","children":[],"created_at":"2026-07-23T05:02:00.000Z","created_at_i":1784782920,"id":49017153,"options":[],"parent_id":49016979,"points":null,"story_id":49016099,"text":"Does it, though? It discourages humans from putting in effort because their time will not be rewarded. But the slop reports were not the result of time nor effort. I'd rather expect changing a payout from $1k to $250 doesn't meaningfully move the needle on someone spending two minutes prompting their OpenClaw to spam bug bounties. Especially since the reports you actually want to filter out are the sub-50-IQ reports that were always going to get $0 either way.","title":null,"type":"comment","url":null},{"author":"sevenseacat","children":[],"created_at":"2026-07-23T09:30:25.000Z","created_at_i":1784799025,"id":49018955,"options":[],"parent_id":49016979,"points":null,"story_id":49016099,"text":"To my mind, it encourages more reports because that way you're more likely to have some of them slip through and get approved, meaning your future reports are worth more.","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T04:36:03.000Z","created_at_i":1784781363,"id":49016979,"options":[],"parent_id":49016803,"points":null,"story_id":49016099,"text":"It discourages all reports, so you get the reduced slop reports for free.","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T04:05:09.000Z","created_at_i":1784779509,"id":49016803,"options":[],"parent_id":49016547,"points":null,"story_id":49016099,"text":"How does decreasing pay for humans discourage slop reports, exactly?","title":null,"type":"comment","url":null},{"author":"account42","children":[{"author":"inigyou","children":[{"author":"blackqueeriroh","children":[],"created_at":"2026-07-24T05:44:00.000Z","created_at_i":1784871840,"id":49031601,"options":[],"parent_id":49020187,"points":null,"story_id":49016099,"text":"Saying they \u201cown\u201d OpenAI is a massive stretch, considering their stake is less than 30%, post-recapitalization into a PBC.","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T11:59:32.000Z","created_at_i":1784807972,"id":49020187,"options":[],"parent_id":49020128,"points":null,"story_id":49016099,"text":""one of the big" is an understatement. They own OpenAI, which created and popularized the whole field.","title":null,"type":"comment","url":null},{"author":"toomuchtodo","children":[],"created_at":"2026-07-23T12:34:27.000Z","created_at_i":1784810067,"id":49020576,"options":[],"parent_id":49020128,"points":null,"story_id":49016099,"text":"Large organizations are complex machines. The security team responsible for triaging these reports is very likely not the same as the one peddling slop. The nuance and irony is not lost on me.","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T11:54:28.000Z","created_at_i":1784807668,"id":49020128,"options":[],"parent_id":49016547,"points":null,"story_id":49016099,"text":"You're forgetting that GitHub aka Microsoft is one of the big slop peddlers. They made the problem but now don't want to pay for it.","title":null,"type":"comment","url":null},{"author":"tancop","children":[],"created_at":"2026-07-23T13:14:15.000Z","created_at_i":1784812455,"id":49021067,"options":[],"parent_id":49016547,"points":null,"story_id":49016099,"text":"vouch programs where other users put their trust in you are a good thing. this is a centralized vip program where membership can be added or removed from anyone for no reason. there is no guaranteed way to get in. its a private club not a trust system.","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T03:27:51.000Z","created_at_i":1784777271,"id":49016547,"options":[],"parent_id":49016300,"points":null,"story_id":49016099,"text":"It might, but as someone who has to review public vulnerability reports for a much less popular website, I completely understand why they\u2019re building a vouch program to dissuade slop reports. One would presume their internal team is using frontier models for red team agent scanning against potential attack surface, and so this is a potential risk they\u2019re willing to take.
Tragedy of the commons that someone who hasn\u2019t passed the filter yet might have their payout limited.
Vouch - https://news.ycombinator.com/item?id=46930961 - February 2026 (486 comments)","title":null,"type":"comment","url":null},{"author":"greatgib","children":[],"created_at":"2026-07-23T11:43:16.000Z","created_at_i":1784806996,"id":49020015,"options":[],"parent_id":49016300,"points":null,"story_id":49016099,"text":"I find it quite offensive that there is a payout difference for major vulnerabilities when the outcome is the end in the end.
If it was me finding such a vulnerability, this discrimination would offend me so much that I would prefer to sell it to semi-legal actors that would pay multiple of that...","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T02:54:17.000Z","created_at_i":1784775257,"id":49016300,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"So if the "wrong" person finds a critical vulnerability in GitHub, the payout is capped at $10,000. Might reduce the likelihood of it being submitted to the bug bounty program.","title":null,"type":"comment","url":null},{"author":"Klaster_1","children":[],"created_at":"2026-07-23T03:25:41.000Z","created_at_i":1784777141,"id":49016528,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"Dupe: https://news.ycombinator.com/item?id=49010107","title":null,"type":"comment","url":null},{"author":"saagarjha","children":[{"author":"w0m","children":[],"created_at":"2026-07-23T13:03:49.000Z","created_at_i":1784811829,"id":49020927,"options":[],"parent_id":49016797,"points":null,"story_id":49016099,"text":"i mean; that sounds like a win for GH right?","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T04:03:57.000Z","created_at_i":1784779437,"id":49016797,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"I wonder if this incentivizes people to form groups that self-vet for quality submissions to enhance their reputation.","title":null,"type":"comment","url":null},{"author":"applfanboysbgon","children":[],"created_at":"2026-07-23T04:04:33.000Z","created_at_i":1784779473,"id":49016802,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"I mean, this is just a "fuck you", right? "Because there's a lot of LLM spam, we've decided that some researchers will get 1/4th as much pay for reporting the same bug as others, even if they didn't use LLMs". If anything this will have the opposite of the intended effect -- this strongly discourages humans who aren't part of the VIP program from reporting bugs they find to Github, so you'll probably see a higher ratio of LLM spam in the future. And don't be surprised if those bugs get sold elsewhere...","title":null,"type":"comment","url":null},{"author":"wxw","children":[{"author":"cobertos","children":[{"author":"krystalgamer","children":[],"created_at":"2026-07-23T12:34:08.000Z","created_at_i":1784810048,"id":49020570,"options":[],"parent_id":49019308,"points":null,"story_id":49016099,"text":"it's voluntary and a nice incentive for those whose have spent time on getting familiar with the systems.
also given that nowadays most bounty hunters have some level of automation don't see the issue of getting paid by the task instead of the by the hour. diversification of source of income is always good :)","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T10:18:34.000Z","created_at_i":1784801914,"id":49019308,"options":[],"parent_id":49017278,"points":null,"story_id":49016099,"text":"> VIP program for qualified researchers who consistently deliver high-quality, high-impact work.
Almost as though they want the quality and consistency of hired labor but not the cost","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T05:26:46.000Z","created_at_i":1784784406,"id":49017278,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"> We\u2019re formalizing a permanent private/invite-only VIP program for qualified researchers who consistently deliver high-quality, high-impact work.
> VIP program bounty table:
Severity Payout\n -------- --------\n Low $1,000\n Medium $7,500\n High $20,000\n Critical $30,000+\n> Our new public program bounty table:
Severity Payout\n -------- -------\n Low $250\n Medium $2,000\n High $5,000\n Critical $10,000\n\nAnyone can point an LLM to a code base and ask to find a vulnerability - and the initial set of findings is going to be rather lame.
Encouraging researchers to stick to a target and to report 7 lows before getting in will probably make their contributions more valuable.","title":null,"type":"comment","url":null},{"author":"poly2it","children":[],"created_at":"2026-07-23T08:17:15.000Z","created_at_i":1784794635,"id":49018376,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"Does this reflect new pricing in the black (hat) market?","title":null,"type":"comment","url":null},{"author":"sdevonoes","children":[{"author":"frizlab","children":[],"created_at":"2026-07-23T10:00:07.000Z","created_at_i":1784800807,"id":49019167,"options":[],"parent_id":49018919,"points":null,"story_id":49016099,"text":"Most definitely, yeah.","title":null,"type":"comment","url":null},{"author":"embedding-shape","children":[{"author":"account42","children":[{"author":"embedding-shape","children":[],"created_at":"2026-07-23T12:04:10.000Z","created_at_i":1784808250,"id":49020245,"options":[],"parent_id":49020169,"points":null,"story_id":49016099,"text":"Alright, so assuming thats done now, obviously everyone moves to local models. Would the suggestion be to outlaw those too, and if so, what would the enforcement look like?","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T11:58:04.000Z","created_at_i":1784807884,"id":49020169,"options":[],"parent_id":49019191,"points":null,"story_id":49016099,"text":"If the will was there we could shut down commercial providers tomorrow, which would already solve most of the problem.","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T10:03:57.000Z","created_at_i":1784801037,"id":49019191,"options":[],"parent_id":49018919,"points":null,"story_id":49016099,"text":"> So far cons > pros
Lets say 80% of the world's population decides the cons outweight the pros, now what? Put the genie back in the bottle, something that is famously easy and trivial to do?","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T09:25:56.000Z","created_at_i":1784798756,"id":49018919,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"Another reason why LLMs suck. So far cons > pros","title":null,"type":"comment","url":null},{"author":"everfrustrated","children":[{"author":"htrp","children":[],"created_at":"2026-07-23T13:40:58.000Z","created_at_i":1784814058,"id":49021446,"options":[],"parent_id":49019656,"points":null,"story_id":49016099,"text":"still removing work from github.
this is formalizing some very enterprise-esque processes for security research, software resellers anyone?","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T11:06:09.000Z","created_at_i":1784804769,"id":49019656,"options":[],"parent_id":49016099,"points":null,"story_id":49016099,"text":"Seems to me like the game theory here is un-credentialed reporters need to submit their reports through credentialed folks who will vet and take a cut on the way through.
Why take the lower offer by going directly.
That sounds like a win for everyone involved.","title":null,"type":"comment","url":null}],"created_at":"2026-07-23T02:28:23.000Z","created_at_i":1784773703,"id":49016099,"options":[],"parent_id":null,"points":53,"story_id":49016099,"text":null,"title":"Restructuring GitHub's bug bounty program","type":"story","url":"https://github.blog/security/next-chapter-restructuring-githubs-bug-bounty-program/"}