Open Source Vulnerability Reward Program

Google has stopped accepting vulnerability reports for open-source software through its bug bounty program as of October 1. The company will temporarily no longer pay rewards for product flaws found in open-source projects, though reports on its own flagship products continue. The move is drawing attention in the security community, as the open-source incentive program was seen as an important way to support researchers auditing widely used projects.

Google is restricting its bug bounty program covering open source projects after a surge of low-quality, automated vulnerability reports flooded its review process. The company says AI-generated submissions, many invalid or low-value, have overwhelmed security teams, forcing it to narrow eligibility and tighten criteria for rewards. Security researchers are debating the move, with some warning that legitimate findings may now be overlooked as programs tighten rules across the industry.

Google has temporarily stopped accepting product vulnerability reports under its bug bounty program for open-source software as of October 1st. The pause means security researchers can no longer submit findings for Google open-source projects for the time being. The company has not fully explained the reasons, and observers are watching whether the program will resume and what the move means for open-source security research.

Google has paused its open source bug bounty program after being overwhelmed by a wave of AI-generated vulnerability reports. The automated submissions have flooded reviewers with low-quality, often invalid findings, making the program difficult to manage. The move highlights a growing problem for security teams as generative AI tools make it easy to mass-produce bug reports that look plausible but waste researchers' time.