Cybersecurity
Google pauses open-source bug bounty rewards
Google temporarily stopped accepting product vulnerability reports through its open-source software reward programme on 1 October, citing a rise in automated submissions and directing researchers to other reporting routes.
- Google said on 1 October that it had temporarily stopped taking product vulnerability reports through the Open Source Software Vulnerability Reward Program.
- The pause covered open-source projects such as Go, Angular and Protocol Buffers, but it did not affect supply-chain compromise reports or reports filed before 1 October.
- Google said the change followed a significant rise in automated submissions, most of which were not valid, and it did not say whether AI tools had been involved.
- The programme notice said Google would update the rules in the first quarter of 2027, but it gave no date for when product reports would reopen.
Google said on 1 October that it had temporarily stopped accepting product vulnerability reports through its open-source software reward programme. The change affected projects such as Go, Angular and Protocol Buffers, while supply-chain compromise reports and earlier submissions were left in place.
Google said on X that the pause followed a significant rise in automated submissions. It did not provide figures and did not say whether those submissions had been generated with AI tools.
The rules for the Open Source Software Vulnerability Reward Program now carry a notice about the pause. The notice says Google will update the programme in the first quarter of 2027, but it does not give a date for resuming product reports.
Google’s notice pointed researchers towards three other routes: Cloud VRP, the Patch Rewards Program and other reward programmes. It also said the company was still directing reports on flaws tied closely to Google Cloud or AI products to the relevant programmes.
Named in this story
Companies
- paused product vulnerability reports in its open-source reward programme
Products and systems
- Open Source Software Vulnerability Reward Program (OSS VRP)
- the programme whose rules now carry the pause notice
- Go
- one of the flagship repositories affected by the programme
- Angular
- one of the flagship repositories affected by the programme
- Protocol Buffers
- one of the flagship repositories affected by the programme
- Flutter
- one of the flagship repositories listed as flagship
- Bazel
- one of the flagship repositories listed as flagship
- Cloud VRP
- one of the routes Google named for some reports
- Patch Rewards Program
- Google’s programme that pays for accepted security patches
- AI VRP
- another Google reward programme the notice pointed researchers towards
- Google Cloud
- the product family tied to some repositories and reports
How the source tells it
The article is largely a straightforward procedural report, with no distinct emotive framing beyond Google’s own explanation for the pause.
No emotive framing was found in the original.