Google has launched a new program that will pay bounties for bugs found in its open source projects.
The Open Source Software Vulnerability Rewards Program (opens in new tab) (OSS VRP) is the latest addition to the tech giant’s existing VRPs offering up cash for discoveries.
The company says that its first VRP, aimed at those who helped secure Google’s code, was one of the first in the world. Already in its second decade of operation, Google is keen to highlight its commitment to supporting security researchers and bug hunters.
Google OSS bugs
Google says the VRPs cover various Chrome and Android code across the company’s wider operations, which have resulted in over $38 million being paid out to more than 13,000 contributions, from a total of 84 countries.
Furthermore, Google has pledged to invest $10 billion to improve cybersecurity among its own users and open source software consumers.
Google cites Codecov and Log4j as two of the most prominent incidents which have contributed to last year’s 650% year-on-year increase in OSS supply chain-targeted attacks.
Google’s Security Blog (opens in new tab) says the OSS VRP focuses on “all up-to-date versions” of OSS stored in the Google-owned GitHub organization spaces, such as GoogleAPIs and GoogleCloudPlatform, though the “top awards” are reserved for the most sensitive projects, which Google sets out to be Bazel, Angular, Golang, Protocol buffers, and Fuchsia; a list that’s expected to expand after the initial program rollout.
The targets for any hunters include: “vulnerabilities that lead to supply chain compromise; design issues that cause product vulnerabilities; [and] other security issues such as sensitive or leaked credentials, weak passwords, or insecure installations.”
Rewards range from a measly $100 to a substantial $31,337, depending on the severity of the vulnerability uncovered, however any applicable bugs that are found that do not relate specifically to this VRP shall not be wasted, with Google promising to redirect any findings to the relevant VRP (and pot of cash).
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba