Google OSS VRP product-report pause

Google’s open-source vulnerability reward rules say the program stopped accepting new product-vulnerability submissions on October 1, 2026. Reports submitted before then are unaffected; Google continues to welcome supply-chain issues and points researchers to other reward programs for some product flaws. TechCrunch reported on October 4 that Google attributed the pause to a rise in automated submissions, most of which it says were invalid. The company plans to give an update in the first quarter of 2027. The change concerns one category within the open-source program, not the end of Google’s entire bug bounty operation.