Google Pauses Open Source Bug Bounty Product Reports

Google has paused product vulnerability reports in its open-source bug bounty program, a temporary stop that took effect on October 1. The company said the change follows a significant rise in automated submissions, the vast majority of which are not valid. Researchers can no longer submit security flaws in the code of widely used open-source projects such as Go, Angular and Protocol Buffers to the Open Source Software Vulnerability Reward Program, known as OSS VRP, and receive a reward. Reports about supply chain compromises are still accepted, and reports filed before October 1 are not affected.

Google called the stop temporary in a post on X on October 1 but did not give figures and did not say whether the automated submissions were produced with AI tools. The program's public rules now carry a notice of the stop. Google commits to an update in the first quarter of 2027 while it reworks this part of the program, but neither the post nor the notice gives a date for accepting product vulnerability reports again.

Under the rules, a product vulnerability is a design or implementation flaw in Google's open source software. To qualify, the flaw must substantially affect the confidentiality or integrity of user data in software built with that code. Examples include memory corruption in file format parsers, a type of flaw where a program writes data where it should not, and path traversal, which lets an attacker reach files outside an intended folder. Google sorts its open source projects into four tiers based on sensitivity. Only the top two tiers, called flagship and important, had listed rewards for product vulnerabilities. The rule change that added the stop notice also removed those amounts: flagship projects previously offered between $500 and $7,500, and important projects offered between $101 and $3,133.70. The update was published to Google's public GitHub copy of the rules on September 30, a day before the X post. Google's tiered repository list, last updated in mid-September, names 26 flagship repositories and 47 important ones. The flagship tier includes Go, Angular, Flutter, Bazel and Protocol Buffers.

Supply chain compromises, which are flaws that could let someone tamper with a project's source code or published packages, keep their listed rewards. They range from $3,133.70 to $31,337 for flagship projects, $1,337 to $13,337 for important projects, and $500 to $3,133.70 for standard projects. Other security issues, such as leaked credentials that give write access, still pay $1,000 for flagship and $500 for important projects. The fourth tier, for low-priority projects, has no listed rewards.

Google's notice names three routes for researchers who would have submitted product vulnerability reports. Product vulnerability reports may still be accepted for some Google Cloud repositories that affect Google Cloud products, but the notice does not name them. Under the Cloud VRP rules, a flaw in an open source repository maintained by Google Cloud that affects Cloud products is rated at most IT3b, the tier used for acquisitions and lower-priority products. The Patch Rewards Program pays $100 to $15,000 for security patches to projects it covers, not for vulnerability reports; a project's maintainers must accept a patch and it must remain in place for one month before submission. Google also asks researchers to check whether a flaw affects something covered by another reward program, such as the Cloud VRP or the AI VRP, and submit it there. The notice does not say whether Google will still take product vulnerability reports without a reward.

Some project policies point to other channels. The Go project takes security reports by email to its own security team. A security policy in Google's GitHub organization sends reporters to Google's vulnerability reporting address, g.co/vulnz. Angular's security policy, as of October 6, says Angular is part of the OSS VRP and sends vulnerability reports to Google's Bug Hunters site, with no other channel named.

Google launched the OSS VRP in August 2022. In March 2026, it began requiring stronger proof for reports in some tiers to filter out low-quality submissions; a patch already merged into the project is one accepted form of proof. InfoWorld reported at the time that the program team was concerned about low-quality AI-generated submissions, many of which included invented details about how a vulnerability could be triggered. Separately, the Go project added a section on reports generated by large language models, or LLMs, to its security policy in early September. It asks reporters not to send such reports without reviewing and filtering them first. The policy says LLMs are good at finding real security bugs and just as good at reporting ones that do not exist. Reporters who forward large amounts of unfiltered LLM output will not be credited for their findings.

For website owners, developers and IT teams, the pause means that a reward stream for product flaws in widely used Google open source projects is temporarily closed, but it does not change the need to keep dependencies updated. Open source components such as Angular, Go and Protocol Buffers underpin many websites, web applications and cloud services; security patches still arrive through normal project maintenance. The practical response is to watch official security channels for the projects you use, apply updates promptly, and use your own vulnerability scanning rather than waiting for a paid report. For website owners whose sites rely on open source components, a pause in reward reports does not stop the need for routine patching; AEU Hosting offers managed WordPress hosting secured end to end, which can help site owners keep security updates and hardening in one place. If you discover a suspected flaw, report it through the project's documented channel and avoid forwarding unverified automated output, which is exactly what Google says has overloaded the program.