Google has stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP), the bug bounty for its open-source projects such as Go, Angular and Protocol Buffers.
What Google's published change says:
- The program's rules now state: "As of October 1, 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP."
- For some Google Cloud repositories that affect Google Cloud products, reports may still be accepted through the Cloud VRP.
- Google says it will "continue to reformat and work on this aspect of the OSS VRP" and commits to an update in Q1 2027.
- Researchers are pointed to Google's other reward programs or its Patch Rewards Program.
- Product vulnerabilities submitted before October 1, 2026 are not affected.
- The same change replaced the listed product-vulnerability reward amounts with a dash. The change was committed to Google's public rules repository on September 30, 2026, per the commit date.
What The Hacker News reports on top of that:
- Google called the stop temporary in a post on X on October 1, and said it was due to "a significant rise in automated submissions, the vast majority of which are not valid." The post gave no figures and did not say whether the submissions were produced with AI tools.
- The removed amounts were $500 to $7,500 for flagship projects and $101 to $3,133.7 for important ones. Google's list of tiered repositories names 26 flagship and 47 important repositories, and the flagship tier includes Go, Angular, Flutter, Bazel and Protocol Buffers.
- Supply chain compromise reports keep their rewards, as do other security issues such as leaked credentials that give write access.
- The Patch Rewards Program pays $100 to $15,000 for accepted security patches, not for vulnerability reports.
What we could not confirm: we did not open Google's X post or its rules page directly, so the X quote, the tier counts and the Patch Rewards range come from The Hacker News. Google's own text, read from its rules commit, confirms the October 1 date, the Q1 2027 update and the removed rewards.
Sources: Google's bughunters repository commit "OSS VRP product vuln pause" (Sept 30, 2026), and The Hacker News report of October 6, 2026.