Google will soon shut down the Google Play Security Reward Program (GPSRP) after determining that it has achieved its goal.
Google recently started informing bug bounty hunters who participated in the program that it’s winding down the GPSRP, noting that its decision comes after seeing a decrease in actionable vulnerability reports “as a result of the overall increase in the Android OS security posture and feature hardening efforts”.
According to a message posted on the bug bounty program’s page, new submissions will be accepted until August 31, 2024, with final reward decisions being made until September 30, when the program will be officially discontinued.
As part of the Google Play bug bounty program, the tech giant has collaborated with the developers of some popular Android apps to help them find and patch vulnerabilities in their products.
Bug bounty hunters could earn up to $20,000 for remote code execution exploits that required no interaction, and up to $5,000 for the theft of sensitive data without user interaction.
Google said the project was launched to encourage application developers to establish their own security programs and it has achieved its goal after seven years.
The tech giant’s announcement comes just months after a tenfold increase in payouts for vulnerabilities in its own mobile applications, with researchers being able to earn as much as $450,000 for a single vulnerability report.