Google runs Bug Hunters, its own reporting and reward platform, covering Google, Chrome, Android and the open source it maintains. There is no profile to claim here.
Rewards are set by a panel against a published table, and the amount turns on report quality as much as severity: a clear reproduction routinely lands higher than the same bug described loosely.
Featured write-up
“Majorly I participate in Google VRP mostly as a casual and daily user rather than doing dedicated, aggressive bug hunting. Most of the security flaws I have reported came from normal day to day usage of Google products rather than active deep scanning. The sheer size of the target surface means anyone with a security mindset can spot imp…”
Getting credit
Credit publishes in Google’s own advisories, often months after the report. We index those, so it is waiting for you, including recognitions that carry no CVE and appear nowhere else.
Found a vulnerability?
Google runs its own vulnerability reporting process. Here are your two ways to report it. We recommend the first.
Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Majorly I participate in Google VRP mostly as a casual and daily user rather than doing dedicated, aggressive bug hunting. Most of the security flaws I have reported came from normal day to day usage of Google products rather than active deep scanning. The sheer size of the target surface means anyone with a security mindset can spot impactful vulnerabilities, while experts still have room to dig into obscure endpoints and under-explored domains. The triage team is technically solid, supportive, and fair when aligning scope, though response times can occasionally slow down due to the recent heavy influxes of AI based low quality submissions from others. Overall, it remains a highly transparent, well-coordinated program that I readily recommend. Experiences vary across sub-categories like Chrome VRP or Android VRP, but the main Google VRP track covering web products, AI, and Cloud is consistently smooth to work with.
Log in to comment