Watch condition: Check Google’s Q1 2027 update for whether product-vulnerability submissions return to OSS VRP, remain routed elsewhere, or become subject to new criteria. The rules also note that third-party dependency reports must demonstrate impact in Google OSS and be submitted only after the upstream issue has been fixed for at least 30 days.
Thesis
Google’s OSS VRP is narrowing the types of vulnerability reports it accepts, while retaining separate channels for some issues.
Observed facts
Mechanism
The rules route researchers toward other VRP programs or Patch Rewards, separating product-vulnerability reports from the OSS VRP’s remaining scope, which includes supply-chain compromise issues.
Why now
The published rule sets a dated eligibility boundary and promises an update in Q1 2027.
Implications
Researchers assessing a Google open-source finding need to check its category and route before submitting; product-impacting issues may require a different program.
Evidence boundary
The supplied official rules do not say the change was prompted by AI-generated or otherwise low-quality reports, so that explanation is not established here.
Watch conditions
Check Google’s Q1 2027 update for whether product-vulnerability submissions return to OSS VRP, remain routed elsewhere, or become subject to new criteria.