#97 · Briefing · 10/7/2026

Google Pauses Open Source Bug Bounty

Google has temporarily suspended product vulnerability submissions for its open-source bug bounty program following an influx of automated reports, with updates expected in early 2027.

AI-generated illustration. Google Pauses Bug Bounty Program

Google enacted a temporary suspension on accepting new product vulnerability submissions for its Open Source Software Vulnerability Rewards Program, effective October 1, 2026. This administrative freeze halts a specific intake channel for identifying security flaws in the company's open-source assets. While this particular pathway is offline, the decision does not impact supply chain reports or any vulnerability cases that security researchers submitted prior to the October deadline.

According to Google, the pause was triggered by a significant rise in automated submissions, the vast majority of which the company identified as invalid. Google originally launched this specific open-source initiative in August 2022, establishing a payout structure that offered rewards ranging from $100 to $31,337 for verified vulnerabilities.

The suspension of these submissions highlights the ongoing operational challenges of managing public vulnerability reward programs. Despite this pause, security researchers can still submit security patches through the Google Patch Rewards Program, which continues to offer financial incentives up to $15,000. This ongoing avenue ensures that active contributions to Google's codebase remain compensated, even as the primary vulnerability reporting channel is restructured. Since the inception of its broader Vulnerability Rewards Program in 2010, Google has distributed more than $81.6 million to the external research community. This investment reached a record high in 2025, when the company awarded $17.1 million to over 700 security researchers, representing a 40 percent increase from the $12 million distributed in 2024.

Other organizations have recently adjusted their external security programs in response to similar operational pressures. In mid-September, Intel removed all financial rewards for security flaws within its Intigriti bug bounty program. Additionally, the maintainer of the curl project ended its HackerOne bug bounty program in January, citing the administrative burden of being overwhelmed by low-quality, automated vulnerability reports.

It remains unknown what specific technical changes Google will implement to address the influx of automated submissions. The company has indicated that it plans to provide an official update regarding upcoming modifications to the Open Source Software Vulnerability Rewards Program during the first quarter of 2027.