{"rid":"compute/google-open-source","card":{"rid":"compute/google-open-source","eid":"google","topic":"compute","slug":"google-open-source","provider":"Google Open Source","url":"https://bughunters.google.com/open-source-security/patch-rewards","domain":"google.com","category":"cloud VM","tier":null,"verdict":"qualifies-with-caveat","vorder":1,"grp":"usable","confidence":"documented","binding":"write-gated","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"rest","egress_metered":null,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-22T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-22","stale_on":"2026-11-21","n_evidence":3,"usd_month":null,"usd_per_tb_month":null,"summary":"Quoted: 'you can claim rewards for proactive improvements you've made to security in open source projects. Any patch (typically a merged GitHub pull request)...","duplicate_of":null,"n_unknown":9},"record":{"topic":"compute","slug":"google-open-source","provider":"Google Open Source","url":"https://bughunters.google.com/open-source-security/patch-rewards","category":"cloud VM","free_tier":{"stated":"Quoted: 'you can claim rewards for proactive improvements you've made to security in open source projects. Any patch (typically a merged GitHub pull request) that you can demonstrate to have improved the security of an in-scope project will be considered for a reward.' Published tiers: USD 500 for a one-liner, USD 2,000 for modest complexity, USD 7,500 for moderately complex, USD 15,000 for complicated high-impact work, with a '2x multiplier' and a '3x multiplier' for secure-by-design memory-safety work until the end of 2026.","unit":"none","metered_on":"wall-clock","source_url":"https://bughunters.google.com/open-source-security/patch-rewards","read_on":"2026-10-22","notes":"cash-bounty"},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://bughunters.google.com/open-source-security/patch-rewards","notes":null},"retention":{"stated":"not applicable","days":null,"source_url":"https://bughunters.google.com/open-source-security/patch-rewards","notes":null},"egress":{"terms":"not stated","metered":false,"free_allowance":null,"price_per_tb":null,"source_url":"https://bughunters.google.com/open-source-security/patch-rewards"},"interface":["rest"],"interface_detail":"inferred from the tooling the provider documents; not probed","tooling":"not stated","chaining":"A 3x multiplier on a tier-1 core data parser pays USD 45,000 for one API-compatible Rust rewrite, which is 4.5 times the USD 10,000 GitHub grant and 6.4 times the USD 7,000 Outreachy stipend, and it needs no company, no card and no interview.","limits":[{"kind":"write-gated","value":"A merged pull request in an in-scope project comes before any payment, and the multiplier that makes the ceiling interesting expires 2026-12-31, so the top of the range is a two-month window.","source":"https://bughunters.google.com/open-source-security/patch-rewards"}],"limits_note":"A merged pull request in an in-scope project comes before any payment, and the multiplier that makes the ceiling interesting expires 2026-12-31, so the top of the range is a two-month window.","binding":"write-gated","binding_note":"A merged pull request in an in-scope project comes before any payment, and the multiplier that makes the ceiling interesting expires 2026-12-31, so the top of the range is a two-month window.","identity_cost":{"kind":"email","detail":null,"country":null},"reliability_note":"no reliability event recorded","confidence":"documented","evidence":[{"url":"https://bughunters.google.com/open-source-security/patch-rewards","date":"2026-10-22","proved":"quoted the four reward tiers, the 2x and 3x memory-safety multipliers 'until the end of 2026', and the two worked examples: USD 10,000 for a Struts sandbox, USD 5,000 for a patched Go cors denial-of-service"},{"url":"https://bughunters.google.com/about/rules/open-source/patch-rewards-program-rules","date":"2026-10-22","proved":"the in-scope definition: tier 1 is an explicit project list at github.com/google/bughunters/blob/main/patch-rewards-program/scope.md; any project that receives a Google vulnerability report is also in scope for the patch that fixes it; tier 2 is every project integrated into OSS-Fuzz"},{"url":"https://sos.dev/","date":"2026-10-22","proved":"SOS Rewards was decommissioned after paying USD 353,000 for 189 improvements in 24 months, and the page redirects individuals to this Patch Rewards programme instead"}],"verdict":"qualifies-with-caveat","verified_at":"2026-10-22T00:00:00.000Z","notes":"This is the highest cash-per-action figure and the only one with no application, no deadline and no cohort. The gate is real skill plus scope: tier 1 is a fixed project list and tier 2 is the OSS-Fuzz set, so the work has to land in code somebody else depends on. Recorded after finding that the more famous Secure Open Source Rewards pilot is gone: sos.dev states it was decommissioned and names this programme as the replacement, which is why the dead programme belongs in the notes of the live one rather than in the corpus as a dead record.","extras":{"wave2":{"class":"bounty-individual","free_tier_kind":"cash-bounty","shape":null}}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:write-gated","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[["$.egress.metered","egress-unknown"],["$.egress.terms","not-stated"],["$.identity_cost.detail","process"],["$.per_object_cap.notes","process"],["$.per_object_cap.stated","not-applicable"],["$.reliability_note","none-observed"],["$.retention.notes","process"],["$.retention.stated","not-applicable"],["$.tooling","not-stated"]],"history":[],"drift":[]}