Google Launches Major Open Source Bug Bounty Program

guest · Sep 3, 2022

By Phil Muncaster UK / EMEA News Reporter, Infosecurity Magazine - August 30, 2022

Google today announced a new program designed to reward researchers that find bugs in its open source projects.

The Open Source Software Vulnerability Rewards Program (OSS VRP) will incentivize ethical hackers to make open source code more secure in major projects that Google maintains such as Golang, Bazel, Angular, Fuchsia and Protocol buffers.
Click to expand...

The OSS VRP will specifically focus on all up-to-date versions of open source software and repository settings stored in the public repositories of Google-owned GitHub organizations, as well as these projects’ dependencies.
Google said it welcomes submissions of:

Vulnerabilities that lead to supply chain compromise

Design issues that cause product vulnerabilities

Other issues such as sensitive or leaked credentials, weak passwords or insecure installations

Click to expand...

“Depending on the severity of the vulnerability and the project’s importance, rewards will range from $100 to $31,337,” the tech giant said. “The larger amounts will also go to unusual or particularly interesting vulnerabilities, so creativity is encouraged.”
Click to expand...

Google Open Source Software Vulnerability Reward Program Rules

Google’s Open Source Software Vulnerability Reward Program recognizes the contributions of security researchers who invest their time and effort in helping us secure open source software released by Google (Google OSS). Through this program, we provide monetary rewards and public recognition to researchers who disclose vulnerabilities in Google OSS to us.
Repositories in scope
The program covers all the latest versions of open source software stored in the public repositories of Google-owned GitHub organizations and selected repositories hosted on other platforms.

The program also covers repository configuration settings (e.g. GitHub actions, access control rules, GitHub application configurations). [...]
Click to expand...

Log in or Sign up

Google Launches Major Open Source Bug Bounty Program

guest Guest

Log in or Sign up

Google Launches Major Open Source Bug Bounty Program

guest Guest

Useful Searches