Security Reward Programs: Year in Review, Year in Preview

Posted by Eduardo Vela Nava, Security Engineer 

Since 2010, our Security Reward Programs have been a cornerstone of our relationship with the security research community. These programs have been successful because of two core beliefs:

• Security researchers should be rewarded for helping us protect Google's users. 
• Researchers help us understand how to make Google safer by discovering, disclosing, and helping fix vulnerabilities at a scale that’s difficult to replicate by any other means.

We’re grateful for the terrific work these researchers do to help keep users safe. And so, we wanted to take a look back at 2014 to celebrate their contributions to Google, and in turn, our contributions back to them.

Looking back on 2014

Our Security Reward Programs continue to grow at a rapid clip. We’ve now paid more than $4,000,000 in rewards to security researchers since 2010 across all of our reward programs, and we’re looking forward to more great years to come.

In 2014:

• We paid researchers more than $1,500,000.
• Our largest single reward was $150,000. The researcher then joined us for an internship.
• We rewarded more than 200 different researchers. 
• We rewarded more than 500 bugs. For Chrome, more than half of all rewarded reports for 2014 were in developer and beta versions. We were able to squash bugs before they could reach our main user population. 

The top three contributors to the VRP program in 2014 during a recent visit to Google Zurich: Adrian (Romania), Tomasz (Poland / UK), Nikolai (Ukraine)

What’s new for 2015

We are announcing two additions to our programs today.

First, researchers' efforts through these programs, combined with our own internal security work, make it increasingly difficult to find bugs. Of course, that's good news, but it can also be discouraging when researchers invest their time and struggle to find issues. With this in mind, today we're rolling out a new, experimental program: Vulnerability Research Grants. These are up-front awards that we will provide to researchers before they ever submit a bug.

Here’s how the program works:

• We'll publish different types of vulnerabilities, products and services for which we want to support research beyond our normal vulnerability rewards. 
• We'll award grants immediately before research begins, with no strings attached. Researchers then pursue the research they applied for, as usual.
• There will be various tiers of grants, with a maximum of $3,133.70 USD.
• On top of the grant, researchers are still eligible for regular rewards for the bugs they discover. 

To learn more about the current grants, and review your eligibility, have a look at our rules page.

Second, also starting today, all mobile applications officially developed by Google on Google Play and iTunes will now be within the scope of the Vulnerability Reward Program.

We’re looking forward to continuing our close partnership with the security community and rewarding them for their time and efforts in 2015!