Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Executive Summary

Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software.

The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, and reports filed before October 1 are Continuous validation across global root store trust programs and web telemetry confirms that infrastructure teams must proactively audit cipher agility, inspect multi-log Certificate Transparency receipts, and verify intermediate certificate chain presentation to prevent widespread handshake aborts.

Technical Context

Modern web infrastructure requires continuous validation of certificate lifecycle states. Industry requirements from Apple, Google, and the CA/Browser Forum continue to tighten TLS validation rules, root trust programs, and certificate lifespans.

Key Considerations for Infrastructure Teams

• Certificate Transparency Compliance: Verify that all newly issued certificates are logged in at least two independent CT logs to avoid browser rejection.
• Automated Revocation Checking: Monitor OCSP responder availability and CRL distribution points to preempt invalidation events.
• Intermediate Chain Integrity: Confirm that complete intermediate bundles are delivered during the TLS handshake to prevent mobile handshake aborts.

Recommended Mitigation Steps

1. Audit active public endpoints for certificate expiration deadlines within the next 30 days.
2. Verify that automated renewal hooks (Certbot, cert-manager) reload web server configs upon renewal.
3. Configure real-time rogue certificate detection across your domain names.