Google's Open Source Software Vulnerability Reward Program stopped accepting product-vulnerability reports on October 1, 2026, citing a significant rise in automated submissions that are mostly invalid. Commit f8bf23ad8 in google/bughunters (Sept 30) replaced the product-vulnerability reward bands ($500–$7,500 for flagship projects, $101–$3,133.7 for important ones) with dashes, while supply-chain compromise rewards stay at up to $31,337. Reports filed before Oct 1 are unaffected, some Google Cloud repos can route via Cloud VRP, and Google promises an update in Q1 2027.

Key Takeaways

  • ✓Effective 2026-10-01: OSS VRP no longer accepts product vulnerabilities (rules)
  • ✓Zeroed bands: $500–$7,500 (flagship) and $101–$3,133.7 (important) replaced with dashes in commit f8bf23ad8
  • ✓Unchanged: supply-chain compromises still pay $3,133.7–$31,337 (OT0) and $1,337–$13,337 (OT1)
  • ✓Pre-Oct 1 reports unaffected; some Google Cloud repos can go via Cloud VRP; Patch Rewards remains open
  • ✓Google commits to an update on the product-vulnerability track in Q1 2027
🧭

Turn your technical choice into a development budget

Compare 29+ dev plans & simulate token costs vs $20/mo subscriptions

⚔️ Compare Model→💰 Compare plans & limits↗
🔗

Project Links & Resources

Direct Access
Direct access to official project resources and documentation
📖
Google OSS VRP rules (bughunters.google.com)
bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules
↗
🐙
google/bughunters commit f8bf23ad8 — OSS VRP product vuln pause
github.com/google/bughunters/commit/f8bf23ad82
↗
🐙
OSS VRP rules source file on GitHub
github.com/google/bughunters/blob/main/bughunters/articles/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules.md
↗
📖
Google Patch Rewards Program rules
bughunters.google.com/about/rules/4928084514701312/patch-rewards-program-rules
↗
🔬

In-Depth Technical Analysis

Background

Generative tools made plausible-looking vulnerability reports almost free to produce, and triage cost exploded. Google's OSS VRP rules now state that as of October 1, 2026 the program no longer accepts product vulnerabilities; per TechCrunch, Google said the pause is due to a significant rise in automated submissions, the vast majority of which are not valid.

What changed

Commit f8bf23ad8 (Sept 30, "OSS VRP product vuln pause") added the notice and replaced the product-vulnerability reward row with dashes. Supply-chain compromises (bypassing PR review to land code on main, build/release infrastructure, publishing credentials) still pay by project tier.

Numbers

No benchmarks apply. Old product-vulnerability bands were $500–$7,500 (OT0) and $101–$3,133.7 (OT1); supply-chain bands remain $3,133.7–$31,337 (OT0), $1,337–$13,337 (OT1) and $500–$3,133.7 (OT2). Google did not publish counts of invalid reports.

What to do

Reports filed before Oct 1 are unaffected; some Google Cloud repos can route via Cloud VRP; fixes can go to the Patch Rewards Program. AI-assisted researchers should treat a working PoC as the entry ticket. Teams depending on Google OSS should lean on their own dependency review until Google's Q1 2027 update.

Action HubReady to adopt this in production?

Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.

⚔️ Launch VS Compare→💳 View Plans↗