Google Patch Rewards Program for open source security fixes
Google pays $100 to $15,000 for patches that improve security in open source projects such as those in OSS-Fuzz. Rolling, no deadline.
The Google Patch Rewards Program pays developers for proactive security improvements in open source projects. It focuses on projects that are important dependencies for Google and for the wider open source community. Rewards range from $100 to $15,000 per qualifying submission.
Tier 1 covers the projects on Google's scope list on GitHub, plus any open source project that received a vulnerability report from Google, for patches that help fix that report. Tier 2 covers projects integrated into OSS-Fuzz. New OSS-Fuzz integrations and fuzz harnesses do not qualify.
Examples of qualifying work include sandboxing, memory allocator hardening, fixes for race conditions and refactoring that makes security easier to check. Google also lists memory safety work, such as replacing C++ dependencies that process untrusted input with Rust code. A patch that fixes only one vulnerability may qualify, but Google reviews these case by case.
The top reward is $15,000 for a complex, high impact patch on a Tier 1 project and $5,000 on a Tier 2 project. A rewards panel decides the final amount and may split it between the submitter and the maintainers.
First send the patch to the project maintainers. It must be accepted and stay in the repository without a revert for one month. Then submit it through Google's form with links to the code and diffs. Patches older than 12 months are not eligible, and each person can send at most 3 submissions per month.
Quick answers
Can project maintainers claim rewards for their own patches?
Yes. Core developers of in scope projects can submit their own patches.
Are simple crash fixes rewarded?
In general no. Google does not reward one line patches that fix crashes which cannot be exploited, including crashes from resource exhaustion.
Are there bonuses for memory safety work?
Until the end of 2026, memory safety improvements on Tier 1 projects earn 2x, and 3x for projects marked as core infrastructure data parsers. The one liner category is excluded.