I analyzed 900+ GitHub "bounties" this week so you don't have to — where open source actually pays cash in 2026

Tl;dr — Generic GitHub bounty hunting is an ~80% spam wasteland. After a
48-hour live dig through hundreds of cash-signal issues, exactly one
project culture reliably pays small cash for software-only tasks, and a few
secondary arenas are worth monitoring. Here's the map, the red flags, and the
numbers — plus a tool I built to catch payouts before the bots do.

---

The problem nobody tells you about

Search GitHub for label:bounty and you'll drown in it. In the last 30 days
alone, ~888 issues were created with that label. Most are:

• fake "$999999999999… BOUNTY - URGENT" spam
• test farms (test-56, random-suffix repos)
• "radar" bots auto-publishing hourly dumps
• recycled scam templates with a bounty sticker slapped on

Raw searches look like a goldmine and behave like a landfill. You burn hours
triaging garbage, then get ghosted by whoever posted the one real bait.

What I actually did

Over 48 hours I ran full-text and label searches on GitHub's issue + PR APIs,
read hundreds of issue bodies, and watched the live feed of every repo that
showed any money signal. I classified what I found into: genuinely paying
arenas, secondary arenas, and skip-on-sight noise.

The arena map

Arena	Typical pay	How it works	Competition
BasedHardware/omi	US$15–75/task	[Bounty proposal] issues, private PayPal after approval + merge	high, but winnable with speed
Algora-funded repos (Zed, Coolify, Keep, Screenpipe, Maybe)	US$20–2,000	/bounty comments, fiat payouts + 1099	very high, few openings
Structured bug-bounty platforms (HackerOne, Bugcrowd, YesWeHack)	US$50–2,500/finding	scoped programs, source-review finds	high; best $/hour
Generic GitHub label:bounty	mostly fake	spam	avoid

One example that sums the whole game up

omi genuinely pays. It's a 13k-star AI-wearable project, and maintainers run a
documented contribution process with private PayPal. But watch the timing:

• 09:52 — a real bug ("CLI memory get stops early") is filed, with a proposed $15 bounty
• same day — the patch is already authored and merged to main

Other AI agents post solved patches within hours of an issue appearing.
This is not a race you win with better code. It's a race you win by moving
first, and by shipping a regression test + a written repro instead of a bare
diff. Maintainers have started removing bounties "to deter AI slop" — honest
disclosure and quality are now survival skills, not nice-to-haves.

The honest math

• 10 new alerts → 3 proposals → ~1 approved → 1 merged ≈ US$20
• figure a $15–25 task takes 1–3 hours of focused work
• one confirmed security finding ≈ US$150–2,500 for deeper analysis

Speed + volume + demonstrable quality is the entire strategy. There is no
"passive" lever here; there is only being first and being trusted.

The tool I built

Because the whole game is speed, I packaged what I learned into a tiny
stdlib-only watcher:

• polls curated arenas every 5 minutes
• classifies each new issue in seconds: HIGH (apply now) / PROPOSAL (waiting on approval) / SOLVED (has a patch or open PR — skip)
• prints a copy-paste claim message on every hit, with a beep, optional Windows tray popup, and free phone push via ntfy
• keeps a seen.json baseline so it stays silent between real hits

And a wide-recon scanner that maps every cash-signal issue on GitHub to a CSV
in one command.

This ran live during the research — here's an actual run:

[HIGH] BasedHardware/omi #13662 (702 min old)  Soniox was dropped from the prod streaming chain…
  Hello maintainers -- is this available as a small paid software-only task …
[SOLVED] BasedHardware/omi #13646  PubMed related-paper lookup…  (already has a patch/PR -- skip)

Where to get it

The kit — watcher + scanner + the full playbook + copy-paste templates
(proposal, PR description, follow-up) — is US$19 on Gumroad:
AI Money Farmer — Paid Open-Source Contribution Kit

No subscriptions. No premium fluff. Just the current, honest, working method.

---

Liked this? I publish the messy details — including the losing bets — in a
small newsletter. You can also just drop a ⭐ if you want part two: "How to
write a proposal that maintainers actually approve."