---
type: "raw_signal"
id: "google-open-source-software-vulnerability-reward-program-rules-1d9415"
slug: "google-open-source-software-vulnerability-reward-program-rules-1d9415"
title: "Google Open Source Software Vulnerability Reward Program Rules - Rules - Rules & Rewards"
description: "Google’s Open Source Software Vulnerability Reward Program rules say that, as of October 1, 2026, the program no longer accepts product vulnerability submissions."
retrieval_nugget: "Google’s Open Source Software Vulnerability Reward Program rules say that, as of October 1, 2026, the program no longer accepts product vulnerability submissions."
observed_at: "2026-10-06"
record_date: "2026-10-06"
date_kind: "observed_at"
why_it_matters: "Google’s Open Source Software Vulnerability Reward Program rules say that, as of October 1, 2026, the program no longer accepts product vulnerability submissions. The rules say some reports affecting Google Cloud products may still be accepted through the Cloud VRP. Google directs researchers to other VRP programs or the Patch Rewards Program and says the change does not affect product-vulnerabili"
novelty: "notable"
verification_level: "source-linked"
signal_type: "release"
source_platform: "bughunters.google.com"
topics: ["google"]
entities: []
related_patterns: []
source_url: "https://bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules"
source_urls: ["https://bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:google-open-source-software-vulnerability-reward-program-rules-1d9415"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/signals/google-open-source-software-vulnerability-reward-program-rules-1d9415/","markdown":"https://newruntime.com/signals/google-open-source-software-vulnerability-reward-program-rules-1d9415.md","json":"https://newruntime.com/signals/google-open-source-software-vulnerability-reward-program-rules-1d9415.json"}
---

# Google Open Source Software Vulnerability Reward Program Rules - Rules - Rules & Rewards

## Retrieval answer

Google’s Open Source Software Vulnerability Reward Program rules say that, as of October 1, 2026, the program no longer accepts product vulnerability submissions.

Google’s Open Source Software Vulnerability Reward Program rules say that, as of October 1, 2026, the program no longer accepts product vulnerability submissions. The rules say some reports affecting Google Cloud products may still be accepted through the Cloud VRP. Google directs researchers to other VRP programs or the Patch Rewards Program and says the change does not affect product-vulnerability reports submitted before October 1, 2026. The company says it will provide an update on this part of the program in Q1 2027. The same rules continue to identify supply-chain compromises as a priority category.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)