A Clearer Path Into GitHub’s Private Researcher Program

GitHub has spent the early part of the year tuning its bug bounty efforts, including the launch of a swag store for researchers. That work has now led to a significant overhaul of the company’s VIP program—a private, invite-only tier that has existed for five years. The goal of the revamp is straightforward: define clear, attainable criteria for entry while expanding what members get out of it.

Who Gets Invited Now

GitHub’s VIP researchers are called Hacktocats. Invitations are no longer opaque. To receive an invite, a researcher must currently meet two specific benchmarks through the public bounty program:

  • Earned at least $20,000 in bounties.
  • Submitted at least two credible reports within the last two years.

Meeting those thresholds demonstrates consistent, high-impact work on GitHub’s security, which is exactly the profile the program is designed to reward.

What Hacktocats Get

The revamped VIP tier is built around closer collaboration and earlier access. Once inside, researchers connect directly with GitHub staff and other top researchers. The practical benefits include:

  • Early access to a broad set of beta products and features before public release.
  • Direct contact with the security and engineering teams responsible for the beta software being tested.
  • Exclusive Hacktocat merchandise available only through the VIP tier.

Beyond the tangible perks, the program pushes for more learning opportunities by putting researchers in regular contact with the people building GitHub’s products.

Why It Matters

GitHub has long leaned on external researchers to help keep its platform secure. The VIP revamp reflects a more formalized relationship with its most reliable contributors—rewarding sustained credibility with structure, transparency, and better access, rather than leaving invitations to chance.

For full scope, rules, and reward details, GitHub points researchers to the official bug bounty program page.