Home / Google
Google Open Source
bughunters.google.com/open-source-security/patch-rewardsCloud VMcompute/google-open-sourceJSONcomparereport an errorprovider JSON
- Free allowance
- 'you can claim rewards for proactive improvements you've made to security in open source projects.
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- write-gatedA merged pull request in an in-scope project comes before any payment, and the multiplier that makes the ceiling interesting expires 2026-12-31, so the top of the range is a two-month window.
- Evidence
- documented3 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-22checked 2026-10-22 (live); stale on 2026-11-22
| Free tier | 'you can claim rewards for proactive improvements you've made to security in open source projects. Any patch (typically a merged GitHub pull request) that you can demonstrate to have improved the security of an in-scope project will be considered for a reward.' Published tiers: USD 500 for a one-liner, USD 2,000 for modest complexity, USD 7,500 for moderately complex, USD 15,000 for complicated high-impact work, with a '2x multiplier' and a '3x multiplier' for secure-by-design memory-safety work until the end of 2026. unit none; metered on wall-clock; cash-bounty |
|---|
| Price | none stated |
|---|
| Limits | - write-gated (binding) A merged pull request in an in-scope project comes before any payment, and the multiplier that makes the ceiling interesting expires 2026-12-31, so the top of the range is a two-month window. source
|
|---|
| Identity | email not published |
|---|
| Egress | not stated |
|---|
| Interface | rest inferred from the tooling the provider documents; not probed |
|---|
| Tooling | not stated |
|---|
| Composes with | A 3x multiplier on a tier-1 core data parser pays USD 45,000 for one API-compatible Rust rewrite, which is 4.5 times the USD 10,000 GitHub grant and 6.4 times the USD 7,000 Outreachy stipend, and it needs no company, no card and no interview. |
|---|
| Reliability | no reliability event recorded |
|---|
| Notes | This is the highest cash-per-action figure and the only one with no application, no deadline and no cohort. The gate is real skill plus scope: tier 1 is a fixed project list and tier 2 is the OSS-Fuzz set, so the work has to land in code somebody else depends on. |
|---|
| Parsed numbers | |
|---|
Evidence 3
| date | source | what it proved |
|---|
| 2026-10-22 | bughunters.google.com/open-source-security/patch-rewards | quoted the four reward tiers, the 2x and 3x memory-safety multipliers 'until the end of 2026', and the two worked examples: USD 10,000 for a Struts sandbox, USD 5,000 for a patched Go cors denial-of-service |
| 2026-10-22 | bughunters.google.com/about/rules/open-source/patch-rewards- | the in-scope definition: tier 1 is an explicit project list at github.com/google/bughunters/blob/main/patch-rewards-program/scope.md; any project that receives a Google vulnerability report is also in scope for the patch that fixes it; tier 2 is every project integrated into OSS-Fuzz |
| 2026-10-22 | sos.dev/ | SOS Rewards was decommissioned after paying USD 353,000 for 189 improvements in 24 months, and the page redirects individuals to this Patch Rewards programme instead |
More fields 1
| facets | {"class": "bounty-individual","free_tier_kind": "cash-bounty","shape": null} |
|---|
Unknown values 6
- egress metered: egress metering was not published
- egress terms: a source was read and is silent on this field
- per object cap stated: the field does not apply to this kind of offer
- reliability note: nothing of this kind was observed
- retention stated: the field does not apply to this kind of offer
- tooling: a source was read and is silent on this field