Google Has Shut Down Part of its Open Source Bounty Program

Submitting product vulnerability reports is no longer possible. You can thank AI for that.

Since 2022, Google's Open Source Software Vulnerability Reward Program (OSS VRP) has been the path for outside researchers to get paid for reporting security flaws in the company's open source code, including projects like Flutter, Angular, Go, and Fuchsia.

With an announcement on X, they have now decided to discontinue the product-facing side of it.

blackshirt 2 points 8 days ago

Well the program is useless now with Ai being more efficient than humans, right? Right?

save

path: 0 26211414, hotness: undefined, score: 2, children: 3

brucethemoose 2 points 8 days ago

TBH they probably shut it down because LLMs are spamming the bounty system.

save

path: 0 26211414 26211433, hotness: undefined, score: 2, children: 2

partial_accumen 2 points 8 days ago

TBH they probably shut it down because LLMs are spamming the bounty system.

This is the reason. Its stated in the article:

"Why did it come to this? Back in March, a post on the Bug Hunters blog from Google engineers said AI-generated reports were flooding the program. Some were serving up hallucinated information, while others were flagging legit coding errors that had little to no impact on the security posture of the targeted project."

save

path: 0 26211414 26211433 26212203, hotness: undefined, score: 2, children: 0

auzy1 2 points 8 days ago

Pretty much.

And they can run the same AI vulnerability scanners too. No point of paying money to a newbie who just got a Claude subscription.

A lot of the submissions are possibly garbage too which wasn't tested

save

path: 0 26211414 26211433 26211522, hotness: undefined, score: 2, children: 0