Google is no longer accepting OSS VRP product vulnerability submissions

Google has stopped accepting product vulnerability submissions through its Open Source Software Vulnerability Reward Program (OSS VRP). According to the company, the pause was announced on X on October 1, 2026 and is a response to a significant rise in automated submissions. Only product vulnerabilities are covered, and reports submitted before that date are reportedly not affected.

What's happening

In a short update posted to X and to the program's rules page, Google said it is temporarily closing the product vulnerability side of the OSS VRP, which was introduced in 2022 and pays researchers for vulnerabilities found in Google's open-source projects. Google described the reason directly: the pause is "due to a significant rise in automated submissions, the vast majority of which are not valid."

The company did not give a firm reopening date. It said it will "continue to reformat and work on this aspect of the OSS VRP" and committed to giving an update in the first quarter of 2027. Reports of the change were also covered by security news outlets, which placed it alongside Google's other recent bug bounty adjustments. Because program rules can be clarified after the fact, it is worth re-checking the official rules page for the current wording.

Who's affected

The pause affects security researchers and bug hunters who would otherwise submit product vulnerabilities through the OSS VRP. According to Google, it does not affect supply chain reports, and "this change does not affect product vulnerabilities submitted before October 1, 2026." Pending reports are described as unaffected as well.

Google notes that some product vulnerability reports may still be eligible elsewhere. For some Google Cloud repositories that impact Google Cloud products, the company says it may still accept product vulnerability reports through the Cloud VRP. Researchers may also consider the Patch Rewards Program, which rewards proactive improvements to the security of open source projects. Anyone submitting purely automated reports appears to be the group most directly targeted by the change.

What to do

If you already submitted a product vulnerability before October 1, 2026, Google says the change does not affect you, so there is nothing to resubmit.
If you were preparing a new OSS VRP product vulnerability report, check whether the target repository falls under the Cloud VRP, where Google says some reports may still be accepted.
Consider the Patch Rewards Program if your work is about improving the security of open source projects rather than a product flaw.
Keep an eye on the OSS VRP rules page for the promised first-quarter 2027 update, since there is no official reopening date yet.
Avoid submitting automated, unverified reports; Google cites the volume of invalid automated submissions as the reason for the pause.

Sources

Google Bug Hunters — the OSS VRP rules page, updated with the note that product vulnerabilities submitted before October 1, 2026 are unaffected.
Google VRP (X) — the announcement post saying the pause is due to a rise in automated submissions, most of them invalid.
SecurityWeek — reports Google temporarily closed OSS VRP product submissions and expects an update in Q1 2027.