Google pauses open source product vulnerability rewards due to surge in invalid automated reports

Starting October 1, Google stopped accepting product vulnerability reports for projects such as Go, Angular, and Protocol Buffers through the Open Source Software Vulnerability Rewards Program (OSS VRP), and stated on X that the reason was a significant increase in automated submissions, the vast majority of which are invalid. Supply chain poisoning reports are still accepted, and reports submitted before October 1 are unaffected. The rules page simultaneously removed product vulnerability reward amounts of $500 to $7,500 for flagship projects and $101 to $3,133.7 for important projects; Google committed to updating that section of the rules in the first quarter of 2027. Researchers can instead submit through Cloud VRP, Patch Rewards, or other reward programs, while the Go project requires reporting through its security team email.