Google Cloud Introduces New Bug Bounty Tier Worth Up to $250,000

At a glance

Google Cloud has added a new top tier, called Root-in-Cloud, worth up to $250,000 to its Vulnerability Reward Program (VRP). The aim is to better reward deep, human-led research into design flaws as automated tools become more common.

Key points

1. 1

   The tier covers vulnerabilities that require a deep understanding of how systems work, such as bypassing tenant isolation or flaws in logic across multiple services.

2. 2

   To earn a reward, researchers must prove they actually gained full administrative control of any organization or project.

3. 3

   Cases that rely on existing access, leaked account credentials, or user deception are not accepted.

4. 4

   If a researcher gains code execution on Google's internal infrastructure, they must stop exploring immediately, and going further can lead to losing their researcher status.

Why it matters

Vulnerabilities found by security researchers help protect customer data, so changes to reward rules can affect how well cloud users are protected.