I read 499 open 'bounty' issues: 87% are traps, mirrors or points — and the $600 'escrow' sits in an empty repository

A measured audit of GitHub's bounty label, 2026-10-01 to 2026-11-12: 499 open issues, 47 repositories, 10 repos carrying 87% of them, 222 issues that pay in points rather than money, a $600 'escrowed USDC' task whose target file returns 404 in a repository with no commits, and a $1,600 task that embeds a decoy code snippet which grants an authorization bypass if copied. With the scanner and the twelve filters that produce the numbers.