Google pauses accepting vulnerability reports for its open-source projects: it was flooded with useless SI-written reports
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
SI has made mass-mailing reports nearly free, while checking them is still expensive: defenders have to learn to tell real findings from noise.
Since October 1, Google has stopped accepting, through its open-source software vulnerability rewards program (OSS VRP), bug reports in its own products — for example in the Go, Angular and Protocol Buffers projects. According to Tom's Hardware, engineers and project maintainers were receiving many SI-generated reports, and checking showed no vulnerabilities in them. Acceptance of supply-chain reports and via Cloud VRP continues, and already submitted reports will be processed; Google promises to announce the program's future by the end of the first quarter of 2027.
Sources 2