Google runs Bug Hunters, its own reporting and reward platform, covering Google, Chrome, Android and the open source it maintains. There is no profile to claim here.
Rewards are set by a panel against a published table, and the amount turns on report quality as much as severity: a clear reproduction routinely lands higher than the same bug described loosely.
Featured write-up
“Majorly I participate in Google VRP mostly as a casual and daily user rather than doing dedicated, aggressive bug hunting. Most of the security flaws I have reported came from normal day to day usage of Google products rather than active deep scanning. The sheer size of the target surface means anyone with a security mindset can spot imp…”
Getting credit
Credit publishes in Google’s own advisories, often months after the report. We index those, so it is waiting for you, including recognitions that carry no CVE and appear nowhere else.
Found a vulnerability?
Google runs its own vulnerability reporting process. Here are your two ways to report it. We recommend the first.
Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
HackerOne’s own figures for this program, read from its public page, not reported by researchers and not part of the BugRater grade. Captured 22 Sep 2026.
What it pays, by severity
Intake & responsiveness · last 90 days
Getting in the door
Open to submit. Nothing HackerOne publishes stands between a hunter and a first report here.
Over 33 days (18 snapshots): no change on the figures worth watching.
No reviews yet.
Facts published by HackerOne on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 15 Sep 2026.
Organize the world’s information and make it universally accessible and useful.