Home / Google

Google Open Source

bughunters.google.com/open-source-security/patch-rewardsCloud VMcompute/google-open-sourceJSON compare report an error provider JSON

Free allowance: Quoted: 'you can claim rewards for proactive improvements you've made to security in open source projects.
Verdict: caveatusable, with a named limit or an unprobed read path
Cost: no price stated
Identity: emailno card, no phone
Binding limit: write-gatedA merged pull request in an in-scope project comes before any payment, and the multiplier that makes the ceiling interesting expires 2026-12-31, so the top of the range is a two-month window.
Evidence: documented3 sources; a first-party page was read and the sentence quoted
Freshness: stale on 2026-11-22checked 2026-10-22 (live); stale on 2026-11-22

Free tier	Quoted: 'you can claim rewards for proactive improvements you've made to security in open source projects. Any patch (typically a merged GitHub pull request) that you can demonstrate to have improved the security of an in-scope project will be considered for a reward.' Published tiers: USD 500 for a one-liner, USD 2,000 for modest complexity, USD 7,500 for moderately complex, USD 15,000 for complicated high-impact work, with a '2x multiplier' and a '3x multiplier' for secure-by-design memory-safety work until the end of 2026. unit none; metered on wall-clock; cash-bounty
Price	none stated
Limits	write-gated (binding) A merged pull request in an in-scope project comes before any payment, and the multiplier that makes the ceiling interesting expires 2026-12-31, so the top of the range is a two-month window. source
Identity	email not published
Egress	not stated
Interface	rest inferred from the tooling the provider documents; not probed
Tooling	not stated
Composes with	A 3x multiplier on a tier-1 core data parser pays USD 45,000 for one API-compatible Rust rewrite, which is 4.5 times the USD 10,000 GitHub grant and 6.4 times the USD 7,000 Outreachy stipend, and it needs no company, no card and no interview.
Reliability	no reliability event recorded
Notes	This is the highest cash-per-action figure and the only one with no application, no deadline and no cohort. The gate is real skill plus scope: tier 1 is a fixed project list and tier 2 is the OSS-Fuzz set, so the work has to land in code somebody else depends on. Recorded after finding that the more famous Secure Open Source Rewards pilot is gone: sos.dev states it was decommissioned and names this programme as the replacement, which is why the dead programme belongs in the notes of the live one rather than in the corpus as a dead record.

Evidence 3

date	source	what it proved
2026-10-22	bughunters.google.com/open-source-security/patch-rewards	quoted the four reward tiers, the 2x and 3x memory-safety multipliers 'until the end of 2026', and the two worked examples: USD 10,000 for a Struts sandbox, USD 5,000 for a patched Go cors denial-of-service
2026-10-22	bughunters.google.com/about/rules/open-source/patch-rewards-	the in-scope definition: tier 1 is an explicit project list at github.com/google/bughunters/blob/main/patch-rewards-program/scope.md; any project that receives a Google vulnerability report is also in scope for the patch that fixes it; tier 2 is every project integrated into OSS-Fuzz
2026-10-22	sos.dev/	SOS Rewards was decommissioned after paying USD 353,000 for 189 improvements in 24 months, and the page redirects individuals to this Patch Rewards programme instead

More fields 1

{
 "facets": {
  "class": "bounty-individual",
  "free_tier_kind": "cash-bounty",
  "shape": null
 }
}

Unknown values 6

$.egress.metered egress metering was not published
$.egress.terms a source was read and is silent on this field
$.per_object_cap.stated the field does not apply to this kind of offer
$.reliability_note nothing of this kind was observed
$.retention.stated the field does not apply to this kind of offer
$.tooling a source was read and is silent on this field