Google Pauses OSS Product Vulnerability Bounty Reports Amid Surge in Invalid Automated Submissions
Summary
Google temporarily stopped accepting product vulnerability reports for its open-source software bounty program on October 1, citing a surge in mostly invalid automated submissions. Supply-chain compromise reports and submissions filed earlier remain eligible.
Key points
- Since October 1, researchers cannot submit product vulnerability reports to Google’s OSS VRP for rewards; Google has not said whether it will accept them without rewards.
- Reports about supply-chain compromises and other security issues, including leaked credentials granting write access, remain eligible for listed rewards.
- Reports filed before October 1 are unaffected, and Google plans to provide an update in the first quarter of 2027; no date for resuming submissions was given.
- The pause applies to products such as Go, Angular, Flutter, Bazel, and Protocol Buffers, among other projects in the program’s flagship and important tiers.
- Google cited a significant increase in automated submissions, most of which it said were invalid, but did not state whether AI tools produced them.
- The program had introduced stronger proof requirements for some reports in March 2026; Go separately advises researchers to review and filter LLM-generated reports before submitting them.
Article Details
- Event Type
- Google temporarily paused product vulnerability reports under its Open Source Software Vulnerability Reward Program (OSS VRP).
- Impact
- Researchers can no longer submit product vulnerability reports through the program for rewards. Supply-chain compromise reports and reports filed before October 1 remain unaffected. Google removed the listed product-vulnerability rewards of $500–$7,500 for flagship projects and $101–$3,133.7 for important projects. The source does not say whether reports without a reward will still be accepted or when submissions will resume.
Vendors
Products
AngularOctober 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, andBazelGoogle's list of tiered repositories, last updated in mid-September, names 26 flagship repositories and 47 important ones. The flagship tier includes Go, Angular, Flutter, Bazel, and Protocol Buffers.FlutterGoogle's list of tiered repositories, last updated in mid-September, names 26 flagship repositories and 47 important ones. The flagship tier includes Go, Angular, Flutter, Bazel, and Protocol Buffers.Gosince October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are stillOSS VRPThe rules of the program, called the Open Source Software Vulnerability Reward Program (OSS VRP), now carry a notice of the stop. It commits Google to an update in the first quarter of 2027 while it reworks this part ofProtocol Buffersresearchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, and reports filed