← Blog · Sep 11, 2026 · updated Sep 26, 2026
Bug bounty programs vs GitHub issue bounties: what's the difference?
Search "bug bounty programs" and you'll mostly find security research platforms — HackerOne, Bugcrowd, Intigriti. If that's not what you meant, and you're actually a developer looking to get paid for shipping code rather than hacking it, here's the distinction, plus live numbers on the five programs that pay for merged GitHub pull requests instead.
| Security bug bounty | GitHub issue bounty | |
|---|---|---|
| What you're paid for | Finding and responsibly disclosing a security vulnerability | Shipping a merged pull request that fixes a bug, feature, or docs issue |
| Where it happens | HackerOne, Bugcrowd, Intigriti | Algora, Opire, IssueHunt, BountyHub, TaskBounty — directly on GitHub issues |
| Typical payout | $50 for low-severity bugs up to $50,000+ for critical RCE | $20–$500 typical, occasionally $1,000+ on infra-critical repos |
| Skill required | Security research, penetration testing, exploit development | General software development — reading a codebase and shipping a fix |
| Competition | High among specialized security researchers | Varies heavily by platform and repo popularity |
Why the confusion happens
"Bug bounty" became the generic term for "pay for finding/fixing bugs" back when security researchers popularized it in the 2010s. When GitHub issue bounty platforms emerged later using similar language ("bounty," "reward"), the terms started overlapping in search results even though the actual work is unrelated.
Which one should you pursue?
If you have — or want to build — deep security/exploit-development expertise, security bug bounties can pay dramatically more per finding, but expect a long ramp-up and high competition from specialists. If you're a general developer who wants to earn from merged pull requests using skills you already have, GitHub issue bounties (Algora, Opire, IssueHunt, BountyHub, TaskBounty) are the more accessible path — no security background required.
The 5 GitHub issue bounty programs, by real live volume
"Best bug bounty programs" lists online are usually ranked by traffic or SEO, not by how many bounties are actually open right now. Here's what BountyOS's own hourly scanner sees today across all five GitHub issue bounty programs — real counts, not marketing claims.
| Program | Open, verified bounties | Combined value | Share of total |
|---|---|---|---|
| Algora | 261 | ~$21,300 | 90% |
| BountyHub | 11 | ~$2,600 | 9% |
| Opire | 15 | ~$40 | <1% |
| TaskBounty | 1 | ~$10 | <1% |
| IssueHunt | 2 | ~$120 | <1% |
290 bounties, ~$24,070 combined, scanned Sep 26, 2026 — up from 160 bounties (~$25,400) on Sep 16, a sign the market keeps adding volume even as average payout size varies week to week. Algora dominates by count — if you can only track one program, track that one; the other four are worth checking directly since their listings shift week to week. Gitcoin's own issue-bounty program has meanwhile been discontinued in favor of grants (see what changed at Gitcoin), and Bountysource stopped paying out entirely (see Bountysource alternatives) — two more reasons the five platforms above are where real GitHub issue bounty volume actually lives today.
If it's GitHub issue bounties you're after
BountyOS scans all five GitHub issue bounty platforms hourly and scores every issue 0–115, filtering out stale, already-claimed, and honeypot issues automatically.
Start free with GitHubSee live bountiesSee also: Get paid to fix GitHub issues — the complete guide · Algora vs Opire vs IssueHunt vs BountyHub vs TaskBounty