Google VRP (Google Bug Hunters)

init.g(malaga) turns 3 this year! 🎉 We look back at the event's origins, explore its ties with GSEC Málaga (Google's cybersecurity hub in Andalusia), and outline what's new for the 2026 edition 👇 bughunters.google.com/blog/t…

📣📣📣 PSA for all Cloud bug hunters! 📣📣📣 We've created a new $250,000 tier for Google Cloud VRP. Want to know more about why we are introducing this tier and how we expect it to support high-impact architectural research? 👇 goo.gle/47VXtiL

🏁 This year's Hackceler8 finals in Singapore have concluded! 🇸🇬 Huge congratulations to BunkyoWesterns, the crowned Escal8 CTF winners this year! 🏆🥇 Kudos to DiceGang 🎲 for taking 2nd place, and Kalmarunionen and Maple Mallard Magistrates 🪿 for capturing 3rd place after an absolutely legendary battle in the arena! 🥈🥉 #Hackceler8 #GoogleCTF #ESCAL8 #GoogleSingapore #CaptureTheFlag #CyberSecurity

🚩 Flags are waiting to be captured! The Hackceler8 FINALS are about to IGNITE! 🚩 Right here on the ground, the world's elite teams are battling it out live—exploiting vulnerabilities and racing to pwn the challenges in real time. 💻🔥 Who will conquer the arena and capture ultimate fame and glory? 🏆🇸🇬 Competing Teams: Kalmarunionen, r3kapig, Zer0Rocket Wrecks, TeamH4C, Maple Mallard Magistrates, Bunkyo Westerns, Dicegang, and Slices #Hackceler8 #GoogleCTF #CTF #CaptureTheFlag #ESCAL8 #GoogleSingapore

💥 bugSWAT is officially KICKING OFF at Escal8! 💥 We are bringing together Google's security engineers and some of the world's most talented external security researchers under one roof. The mission? Deep-dive into our architectures, hunt for vulnerabilities, and make Google products safer for everyone. 🔐🤝 The target is set. Let’s hunt! 🛠️🎯 #bugSWAT #ESCAL8 #GoogleVRP #BugBounty #GoogleSingapore #CyberSecurity

⚡️ Escal8 Singapore is officially kicking-off! ⚡️ The energy is unmatched as the next generation of cybersecurity talent gathers to learn, compete, and push boundaries. Get ready for next-level hacking, hands-on challenges, and game-changing ideas. 🇸🇬💻🔒 Let's see who climbs to the top! 🚀 #ESCAL8 #initg #GoogleSingapore #CyberSecurity #Hackathon bughunters.google.com/blog/e…

📣📣📣 Calling all Chrome bug hunters! 📣📣📣 Rules updates: We're rewarding more types of deep security research, recognizing high-value fixes across more severity tiers, and providing new opportunities for researcher recognition. For details, see our latest blog post 👇 bughunters.google.com/blog/c…

📢 PSA for open-source bug hunters We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. As an alternative, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program. Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. bughunters.google.com/about/…

Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate. How it works: blog.google/security/agentic… For real-world vulnerabilities PageBreak has discovered 👇 bughunters.google.com/blog/p…

ESCAL8, Google’s annual flagship security conference, is coming to Singapore in October 2026, with a particular focus on AI Agents! 🇸🇬 Check out our blog post to see what's planned in the three main segments of the conference: bugSWAT, Hackceler8, and init.g() 👇 bughunters.google.com/blog/e…

📢📢📢 Attention bug hunters! Want to know more about how brutecat found a vulnerability in Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage? If yes, check out his blog post 👇 bughunters.google.com/blog/b…

📢 Tracking our VRP rules just got easier! We are now mirroring our VRP rules and help articles directly on GitHub. Perfect for automating your workflows and tracking changes. 👇 github.com/google/bughunters

Teamwork makes the dream work 🙌 Google Bug Hunters now supports sharing the recognition (and splitting the financial reward) for reports you have submitted, but were researched and created in collaboration with other researchers. Details 👇 bughunters.google.com/about/…

Interested in crypto 🔒? Check out our latest post which analyzes recent results published by Anthropic and argues that these advances, while significant, do not signal the downfall of cryptography. bughunters.google.com/blog/m…

Check out Daniel's article on finding a privilege escalation in Google Cloud using a chatbot! varonis.com/blog/rogue-agent…

Check out Tomas' post and article on hacking Google using Git integrations. One of these reports even won him Most Valuable Hacker (MVH) at Google's bugSWAT event in Vegas last year!