Google Open Source Software Vulnerability Rewards Program rules update: product vulnerability submissions to stop from October 2026

Google's Open Source Software Vulnerability Rewards Program (OSS VRP) will no longer accept product vulnerability reports starting October 1, 2026. Vulnerabilities affecting Google Cloud products can be submitted to Cloud VRP instead. The program will announce further adjustments in the first quarter of 2027. The program covers the latest versions of public repositories under Google's GitHub organizations and repository configurations, with a focus on rewarding vulnerabilities that could lead to supply chain compromise, such as modifying main branch code, configuration flaws in build and release infrastructure, or leaks of package manager credentials or signing keys. Third-party dependency vulnerabilities must first be fixed upstream for at least 30 days and be proven triggerable in Google OSS. Vulnerabilities in third-party services or platforms themselves are out of scope.