Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Summary: Google stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program as of October 1, citing a significant rise in automated submissions that were mostly invalid, and removed the listed rewards of $500 to $7,500 for flagship projects and $101 to $3,133.7 for important ones. Supply chain compromise reports and reports filed before October 1 are unaffected, and Google committed to an update in the first quarter of 2027 without giving a date for resuming product vulnerability reports.
Why it matters: Google's flagship tier covers 26 repositories including Go, Angular, Flutter, Bazel, and Protocol Buffers, and the notice does not say whether product vulnerability reports will still be accepted without a reward - so researchers holding findings in that code now have to decide where, or whether, to send them.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026