Google launches a bug bounty program for its open-source projects, offering payouts up to $31,337, one of the first open source-specific vulnerability programs
The RecordJonathan Greig
Context & Ripple Effects
Google had already broadened researcher engagement through Bug Hunter University, alongside an established vulnerability-reward program. The open-source program directs that model at projects maintained by Google rather than only its conventional product surfaces.
The related coverage also records the open-source announcement a day earlier, making this report part of the program’s initial rollout rather than a later expansion. Google subsequently applied a similarly targeted approach to Android applications through its Mobile Vulnerability Rewards Program.
First-order effects
Security researchers can receive up to $31,337 for qualifying vulnerabilities in Google’s open-source projects, creating a paid reporting channel for flaws in that code.
Google’s open-source maintainers gain an incentive-backed stream of external vulnerability reports specific to their projects.
Second-order effects
The program gives independent researchers a reason to prioritize Google-maintained open-source code over uncompensated disclosure work, concentrating review on projects covered by the bounty.
Google’s later Android-specific rewards program indicates that targeted bounties can become a repeatable way to focus researcher attention on distinct parts of its ecosystem.
Third-order effects
If targeted reward programs continue to proliferate, large software owners will increasingly treat external researchers as a standing layer of ecosystem security assurance, organized by codebase or product surface rather than one general program.
The trend: Bug bounties are evolving from broad corporate programs into targeted incentives that direct independent security research toward specific ecosystem dependencies.
Google's announced a vulnerability rewards program for open source projects. It concentrates on Google-owned github repositories, but significantly extends to those projects' dependencies. Good stewardship. https://security.googleblog.com/ ... /via @royalhansen and @mjasay
Announcing Google's Open Source Software Vulnerability Rewards Program https://security.googleblog.com/ ... < this looks good. Honestly, you're not really helping Google here as much as helping your favorite ecosystems, cloud vendor, and software provider who uses popular OSS sta…
Over ~12 years @GoogleVRP has paid out >$38M in rewards for security vulnerabilities. Today we're upping our game by launching a new Google OSS VRP for major projects we contribute to like Golang, Angular and Fuchsia. https://security.googleblog.com/ ...
Super exciting. Check out the dataset they offer where you can locate the most used open source packages across several languages. https://twitter.com/...
We're launching a new VRP for Google's open source software, specifically focused on supply chain issues and build compromises. https://security.googleblog.com/ ... (this time with a proper link!)
This is a tweet about how to get* money. *by submitting vulnerabilities to Google's new OSS Vulnerability Rewards Program! Fresh set of scope and rules for researchers from the Google VRP team to cover Google open source projects: https://security.googleblog.com/ ...
#BugBounty is focused on all up-to-date versions of #OSS stored in the public repos of Google-owned GitHub organizations and those projects' 3rd-party dependencies. Top awards will go to bugs found in Bazel, Angular, Golang, Protocol buffers, and Fuchsia https://therecord.media/.…