Technology giant Google has launched a new bug bounty programme where it will award up to $31,337 (nearly ₹25 lakh) to researchers who spot vulnerabilities in the company’s Open Source projects. The newly announced Vulnerability Reward Program (VRP) will focus on Google software and repository settings like GitHub actions, application configurations, and access control rules.
Depending on the severity of the vulnerability and the project’s importance, rewards will range from $100 to $31,337. “The top awards will go to vulnerabilities found in the most sensitive projects: Bazel, Angular, Golang, Protocol buffers, and Fuchsia,” Google said.
The larger amounts will also go to unusual or particularly interesting vulnerabilities, “so creativity is encouraged,” said Google while launching its Open Source Software Vulnerability Rewards Programme (OSS VRP).
As the maintainer of major projects such as Golang, Angular, and Fuchsia, Google is among the largest contributors and users of open source in the world.
Last year, Google saw a 650 per cent year-over-year increase in attacks targeting the open source supply chain.
With the addition of Google’s own vulnerability reward programme (VRP), researchers can now be rewarded for finding bugs that could potentially impact the entire open source ecosystem.
The original VRP programme was one of the first in the world and is now approaching its 12th anniversary.
“Over time, our VRP lineup has expanded to include programmes focused on Chrome, Android, and other areas. Collectively, these programs have rewarded more than 13,000 submissions, totalling over $38 million paid,” Google said in a statement late on Tuesday.
Google said its OSS VRP is part of “our $10 billion commitment to improving cybersecurity, including securing the supply chain against these types of attacks for both Google’s users and open source consumers worldwide”.
(With inputs from IANS)
Download The Mint News App to get Daily Market Updates & Live Business News.
