Google’s Tell Its OSS VRP program offers rewards ranging from $101 to $31,337 to bug finders in open source software, depending on the depth of the vulnerability and the importance of the product. According to the blog, the top award will go to anyone who finds a bug in projects like Golang, Angular, and Fuchsia.
Over time, the VRP lineup has expanded to include programs focused on Chrome, Android and other areas, and collectively these programs have rewarded more than 13,000 submissions, the Alphabet-owned company said. In which a total of more than $ 38 million (about Rs 303 crore) has been paid.
Google is the world’s largest contributor and consumer of open source. Last year, the company saw a 650% year-over-year increase in attacks targeting open source supply chains, including headliner incidents like CodeCov and the log4j vulnerability, which showed the destructive potential of a single open source vulnerability.