- Top reward
- $15,000
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $15,000
- top reward, from $100.
- Report as the policy says
- The policy page explains how.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$15,000
Qualifying submission rewards range from $100 to $15,000.
- Lowest reward
-
$100
Qualifying submission rewards range from $100 to $15,000.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test.
Domains 2
- github.com
- google.com
Source code 1
- Tier 1 : Please see the full list on https://github.com/google/bughunters/blob/main/patch-rewards-program/scope.md
Products and areas 2
- Tier 1 : Any open source project that receives a security vulnerability report from Google (such as from Project Zero ) is eligible for patches which contribute towards fixing the vulnerability .
- Tier 2 : Projects integrated into OSS-Fuzz (Note: Rewards apply to qualifying patches within integrated projects; new project integrations and fuzz harnesses are not eligible).
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Google Patch Rewards's policy. "We" in these lines means the program, not this site.
While testing
-
To qualify, your patch should be submitted directly to the maintainers of the project first, and you should work with them to get it accepted into their repository without reverts for one month
-
Do not submit more than 3 submissions per month per person (we encourage batched submissions)
-
Only submit patches that are at least one month old so that we know that maintainers haven't reverted the patch
-
Do not submit patches that are more than 12 months old as these are not eligible for a reward
-
Please respect the time of your fellow volunteers, and stick closely to the coding, testing, and submission standards for each project.
-
Submissions made before the patch has been accepted (without reverts for one month) will not be considered for a reward.
-
When submitting your patch, please include links to all the relevant code locations and diffs. And be sure to explain project-specific benefits offered by your patch.
-
Please make sure your work does not violate any law(s) and does not disrupt or compromise any data that does not belong to you.
Not accepted
-
In general, we will not reward one-liner patches that fix non-exploitable crashes. This includes crashes that can result from resource exhaustion/DOS.
-
new project integrations and fuzz harnesses are not eligible
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.