<![CDATA[Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports]]>

<![CDATA[Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports]]>Google has paused product vulnerability reports through its bug bounty program for open-source software, effective October 1. Researchers can no longer submit security flaws found in the code of projects such as Go, Angular, and Protocol Buffers for a reward.

A few important details about what still works:

Reports about supply chain compromises are still accepted.
Reports filed before October 1 remain in scope for review under the previous process.

The change follows a surge in invalid automated reports, which appears to have pushed Google to narrow the program's intake while it reassesses how product-level findings in OSS code are handled.

Source: The Hacker News
Has your team adjusted its OSS disclosure workflow since this pause took effect?

]]>https://xploitlk.com/topic/669/google-pauses-oss-product-bug-bounty-rewards-after-surge-in-invalid-automated-reportsRSS for NodeTue, 27 Oct 2026 08:53:58 GMTTue, 13 Oct 2026 06:30:22 GMT60