Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google has halted its bug bounty program for open-source software products, effective October 1, due to a surge in invalid automated reports. As a result, researchers can no longer submit vulnerability reports for projects like Go, Angular, and Protocol Buffers in exchange for a reward. However, reports related to supply chain compromises are still being accepted. Additionally, any reports filed prior to October 1 will still be processed. This change affects the submission of security flaws in the code of these open-source projects. The pause does not impact the handling of previously submitted reports.