The bounty that drew too many reports

Google has stopped accepting product vulnerability reports in its Open Source Software Vulnerability Rewards Program. "We are temporarily no longer accepting OSS VRP product vulnerability submissions," the company's VRP account posted on Thursday. "Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid." Supply-chain reports and reports already in the queue are not affected. Google says it will "continue to reformat and work on this aspect of the OSS VRP" and has committed to an update in the first quarter of 2027.

The programme is four years old. Google launched it on 30 August 2022 to pay for flaws in the open-source code it publishes, from the public repositories of Google-owned GitHub organisations to those projects' third-party dependencies. Rewards ran from $100 to $31,337, with the largest reserved for the projects Google called most sensitive: Bazel, Angular, Golang, Protocol Buffers and Fuchsia. The reason given at the time was the supply chain. Google pointed to Codecov and the Log4j flaw, incidents it said "showed the destructive potential of a single open source vulnerability".

The pause covers the part of the programme that invites the most volume. A product vulnerability report claims a bug in the code itself, and automated tools can now produce one quickly. Checking it takes longer. A Google engineer, or a project maintainer, has to reproduce the claim, decide whether it is real and work out how serious it is. When most submissions fail that check, the cost of reading them falls on the people the programme was meant to help. Google has not said how many reports it received or what share were invalid. BleepingComputer reported that, according to Google's Bug Hunters site, product reports filed before 1 October will still be handled, and that researchers can still send fixes to the Patch Rewards Program, which pays up to $15,000.

Google's wider bounty business is still growing. In its review of 2025, published in March, Google said it paid more than $17m across all its programmes, an all-time high and more than 40 per cent above 2024, to more than 700 researchers. The open-source programme is one line in that total.

Curl got there first. Daniel Stenberg, the project's lead developer, ended its bounty on 31 January. Over almost seven years on HackerOne it had confirmed 87 vulnerabilities and paid more than $100,000. In earlier years, he wrote, more than 15 per cent of submissions turned out to be real vulnerabilities. From 2025 the rate fell below 5 per cent. "Not even one in twenty was real." He blamed "AI slop" along with human reports that were weaker than before, and dropped cash rewards altogether, on the view that money was the incentive for "made up lies". Reports now go to the curl security team privately, with no payment.

Intel went further and has said less. Its programme on the Intigriti platform once offered up to $100,000 per confirmed vulnerability. In September the page was changed to remove all payouts and add a "No bounty" marker, Risky Business reported, with the last archived version showing rewards dated 13 September. Intel declined to tell the newsletter why.

Three programmes have now changed course in nine months, and two of them name the same cause. Bounties pay because outside researchers find real flaws that in-house teams miss. That only works while the good reports are worth the time spent reading all the others. Google's pause takes away the reward for one kind of report, and the reward is what the automated submissions were after.