Google suspends vulnerability reports for open-source software

The company explained the temporary freeze of the Open Source Software Vulnerability Rewards Program (OSS VRP) by a sharp increase in the number of automated submissions. Most of them turned out to be unsubstantiated or contained technical errors and neural network hallucinations, which overwhelmed the engineers and maintainers of projects such as Go, Angular, Fuchsia, and related processes.

The pause will last at least until the first quarter of 2027, when the company intends to provide an update and revise the operational guidelines. At the same time, the restrictions do not apply to submissions filed before October 1, nor to the parallel Cloud VRP reward programs or supply chain vulnerability hunting tracks.

Security specialists still have access to alternative collaboration channels, including the Google Patch Rewards initiative for confirmed fixes, where payouts reach 15 thousand dollars.