Google has stopped accepting reward-eligible product vulnerability reports for its open-source software projects through its bug bounty program, with the change taking effect on October 1. According to the reported update, researchers can no longer submit code vulnerability reports for projects such as Go, Angular and Protocol Buffers there for a bounty, although reports concerning supply chain compromises are still being accepted.

The reported reason is a surge in invalid automated reports. For European businesses that build on widely used open-source components, the decision is a useful signal: security teams are increasingly dealing with higher reporting volume driven by automation, and that can affect how vulnerabilities are identified, triaged and escalated.

What happened

Google has paused one part of its bug bounty intake for open-source software products. Based on the source report, the company is no longer accepting vulnerability submissions related to flaws in the code of certain open-source projects under that reward channel. Reports submitted before October 1 are still being processed, and submissions tied to supply chain compromises remain in scope.

The source indicates the change follows a rise in invalid automated reports. That points to a practical challenge now affecting many security programs: automation can increase the volume of submissions faster than teams can validate them, especially when reports are low quality, duplicated or generated without enough human verification.

Why it matters for European businesses

Many European companies rely directly or indirectly on open-source software maintained by large technology vendors and foundations. Projects such as programming languages, web frameworks and data serialization tools often sit deep inside websites, SaaS platforms, internal applications and customer-facing products.

Google's decision does not mean those open-source projects are no longer receiving security attention. It does, however, show that vulnerability reporting processes are under strain. For businesses, this matters in several ways:

• Open-source dependency risk remains a business risk. Companies using common software components still need visibility into where those components are deployed and how updates are managed.
• Signal-to-noise in security reporting is getting worse. As automated tools and AI-assisted workflows generate more reports, internal security teams and external maintainers may face slower triage and more false positives.
• Supply chain security is still a priority. Google is reportedly continuing to accept reports on supply chain compromises, underlining that tampering in build, packaging or distribution processes remains especially serious.
• SMEs may feel this indirectly. Smaller businesses rarely submit bug bounty reports themselves, but they depend on vendors, agencies and software suppliers to monitor upstream security issues effectively.

The broader lesson is that businesses should not assume external bug bounty programs alone will surface every relevant issue quickly. Software inventory, patch management and supplier oversight remain essential controls.

Who may be affected

• IT and security teams using Google-backed open-source components in production systems.
• Software developers and digital agencies building websites, apps or integrations on frameworks and libraries such as Angular or Protocol Buffers.
• SaaS providers and e-commerce companies whose products depend on open-source packages across application and cloud environments.
• Founders and SME operators who rely on outsourced development and need assurance that software suppliers track component-level security issues.

What companies should consider

• Review software dependencies. Maintain an up-to-date view of key open-source components used in your applications, websites and services.
• Strengthen vulnerability intake processes. If your business runs its own disclosure channel, prepare for more automated and potentially low-quality reports, and define clear triage criteria.
• Prioritise supply chain monitoring. Pay close attention to package integrity, build pipelines, update sources and developer access controls.
• Do not rely on one external signal. Combine vendor advisories, dependency scanning, patch management and threat monitoring rather than depending only on public reports or bounty programs.
• Ask technology partners about open-source governance. Agencies, software vendors and managed providers should be able to explain how they track and remediate upstream vulnerabilities.

For European businesses, the immediate change is limited to Google's bug bounty workflow, but the underlying issue is wider: as automated security reporting grows, companies should expect more pressure on vulnerability management processes across the software ecosystem.