The latest articles on DEV Community by Ben van Tonder (@ben_vantonder_5adfe81555). https://dev.to/ben_vantonder_5adfe81555 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4122985%2Fce51394e-e0db-450e-9b8f-4856896cce54.jpg https://dev.to/ben_vantonder_5adfe81555 en Ben van Tonder Sun, 13 Sep 2026 09:19:49 +0000 https://dev.to/ben_vantonder_5adfe81555/i-analyzed-900-github-bounties-this-week-so-you-dont-have-to-where-open-source-actually-pays-25ag https://dev.to/ben_vantonder_5adfe81555/i-analyzed-900-github-bounties-this-week-so-you-dont-have-to-where-open-source-actually-pays-25ag <h1> I analyzed 900+ GitHub "bounties" this week so you don't have to — where open source actually pays cash in 2026 </h1> <p><strong>Tl;dr</strong> — Generic GitHub bounty hunting is an ~80% spam wasteland. After a<br> 48-hour live dig through hundreds of cash-signal issues, exactly <strong>one</strong><br> project culture reliably pays small cash for software-only tasks, and a few<br> secondary arenas are worth monitoring. Here's the map, the red flags, and the<br> numbers — plus a tool I built to catch payouts before the bots do.</p> <h2> The problem nobody tells you about </h2> <p>Search GitHub for <code>label:bounty</code> and you'll drown in it. In the last 30 days<br> alone, ~888 issues were created with that label. Most are:</p> <ul> <li>fake "$999999999999… BOUNTY - URGENT" spam</li> <li>test farms (<code>test-56</code>, random-suffix repos)</li> <li>"radar" bots auto-publishing hourly dumps</li> <li>recycled scam templates with a bounty sticker slapped on</li> </ul> <p>Raw searches look like a goldmine and behave like a landfill. You burn hours<br> triaging garbage, then get ghosted by whoever posted the one real bait.</p> <h2> What I actually did </h2> <p>Over 48 hours I ran full-text and label searches on GitHub's issue + PR APIs,<br> read hundreds of issue bodies, and watched the live feed of every repo that<br> showed any money signal. I classified what I found into: <strong>genuinely paying<br> arenas</strong>, <strong>secondary arenas</strong>, and <strong>skip-on-sight noise</strong>.</p> <h2> The arena map </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Arena</th> <th>Typical pay</th> <th>How it works</th> <th>Competition</th> </tr> </thead> <tbody> <tr> <td>BasedHardware/omi</td> <td>US$15–75/task</td> <td> <code>[Bounty proposal]</code> issues, private PayPal after approval + merge</td> <td>high, but winnable with speed</td> </tr> <tr> <td>Algora-funded repos (Zed, Coolify, Keep, Screenpipe, Maybe)</td> <td>US$20–2,000</td> <td> <code>/bounty</code> comments, fiat payouts + 1099</td> <td>very high, few openings</td> </tr> <tr> <td>Structured bug-bounty platforms (HackerOne, Bugcrowd, YesWeHack)</td> <td>US$50–2,500/finding</td> <td>scoped programs, source-review finds</td> <td>high; best $/hour</td> </tr> <tr> <td>Generic GitHub <code>label:bounty</code> </td> <td>mostly fake</td> <td>spam</td> <td>avoid</td> </tr> </tbody> </table></div> <h2> One example that sums the whole game up </h2> <p>omi genuinely pays. It's a 13k-star AI-wearable project, and maintainers run a<br> documented contribution process with private PayPal. But watch the timing:</p> <ul> <li>09:52 — a real bug ("CLI <code>memory get</code> stops early") is filed, with a proposed $15 bounty</li> <li>same day — the patch is already authored <em>and merged to main</em> </li> </ul> <p>Other AI agents post solved patches within <strong>hours</strong> of an issue appearing.<br> This is not a race you win with better code. It's a race you win by moving<br> first, and by shipping a regression test + a written repro instead of a bare<br> diff. Maintainers have started removing bounties "to deter AI slop" — honest<br> disclosure and quality are now survival skills, not nice-to-haves.</p> <h2> The honest math </h2> <ul> <li>10 new alerts → 3 proposals → ~1 approved → 1 merged ≈ US$20</li> <li>figure a $15–25 task takes 1–3 hours of focused work</li> <li>one confirmed security finding ≈ US$150–2,500 for deeper analysis</li> </ul> <p>Speed + volume + demonstrable quality is the entire strategy. There is no<br> "passive" lever here; there is only being first and being trusted.</p> <h2> The tool I built </h2> <p>Because the whole game is speed, I packaged what I learned into a tiny<br> stdlib-only watcher:</p> <ul> <li>polls curated arenas every 5 minutes</li> <li>classifies each new issue in seconds: <code>HIGH</code> (apply now) / <code>PROPOSAL</code> (waiting on approval) / <code>SOLVED</code> (has a patch or open PR — skip)</li> <li>prints a copy-paste claim message on every hit, with a beep, optional Windows tray popup, and free phone push via ntfy</li> <li>keeps a <code>seen.json</code> baseline so it stays silent between real hits</li> </ul> <p>And a wide-recon scanner that maps every cash-signal issue on GitHub to a CSV<br> in one command.</p> <p>This ran live during the research — here's an actual run:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>[HIGH] BasedHardware/omi #13662 (702 min old) Soniox was dropped from the prod streaming chain… Hello maintainers -- is this available as a small paid software-only task … [SOLVED] BasedHardware/omi #13646 PubMed related-paper lookup… (already has a patch/PR -- skip) </code></pre> </div> <h2> Where to get it </h2> <p>The kit — watcher + scanner + the full playbook + copy-paste templates<br> (proposal, PR description, follow-up) — is <strong>US$19</strong> on Gumroad:<br> <a href="https://benjaminwebsites.gumroad.com/l/AIMoneyFarmer" rel="noopener noreferrer">AI Money Farmer — Paid Open-Source Contribution Kit</a></p> <p>No subscriptions. No premium fluff. Just the current, honest, working method.</p> <p><em>Liked this? I publish the messy details — including the losing bets — in a<br> small newsletter. You can also just drop a ⭐ if you want part two: "How to<br> write a proposal that maintainers actually approve."</em></p> ai programming