Every submission is evaluated individually. The amounts below are general guidelines for our public and private programs, not guaranteed payouts.
Actual rewards vary based on the affected product, demonstrated impact, exploitability, exposure, the percentage of users or systems affected, and mitigating controls. Product-specific guidance, where available, takes precedence.
| Severity | Public program | Private program |
|---|---|---|
| Critical | $10,000 | $30,000+ |
| High | $5,000 | $20,000 |
| Medium | $2,000 | $7,500 |
| Low | $250 | $1,000 |
| Defense in depth | GitHub swag, no cash bounty | |
GitHub determines the final severity and reward after reviewing the specific facts and demonstrated impact of each submission.