Google has temporarily halted submissions to its Open Source Software Vulnerability Rewards Program due to a surge in automated, low-quality reports. The program, which launched in August 2022 and rewards security researchers for identifying flaws in open-source projects like Golang and Angular, will no longer accept product vulnerability submissions. Google stated that the vast majority of recent automated submissions were invalid. The company is working to address these issues and plans to provide updates in the first quarter of 2027.
Researchers can still submit security patches through Google’s Patch Rewards Program and report vulnerabilities affecting Google Cloud products through its Cloud VRP. Google has distributed over $81.6 million in total rewards since launching its first vulnerability reward program in 2010. This suspension follows similar actions by other organizations, including curl’s decision to end its bug bounty program in January and Intel’s removal of financial rewards for vulnerability reports in September, both citing an overwhelming influx of AI-generated submissions.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
