Source

Google Bug Hunters

1 item

Google's own site for its vulnerability reward programs: program rules, scope, reward tables, and the security engineering blog. Primary for what a program accepts and pays, because the rules page is the document a report is judged against. The pages are rendered in the browser, so a crawler gets almost no text and every claim has to be read by hand before it is used.

bughunters.google.com ↗

Industry

Google stops taking product vulnerability reports in its open source bug bounty

Google no longer accepts product vulnerability reports in its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. Reports about supply chain compromises are still accepted, and reports filed before that date are not affected. Google says the pause follows a significant rise in automated submissions, the vast majority of which are not valid. The company commits to an update in the first quarter of 2027.

GoogleOctober 5verified