Google has announced that its Play Store reward program, which incentivizes security researchers to find vulnerabilities in popular Android apps, will be discontinued on August 31. This information was relayed through an email to the participating researchers.
The decision to terminate the program stems from a reduction in the number of actionable vulnerabilities reported. Google attributes this decline to improvements in the overall security posture of the Android OS and its feature hardening efforts. As a result, fewer significant vulnerabilities have been identified by the research community.
Launched in 2017, the Google Play Security Reward Program aimed to motivate researchers to responsibly identify and report vulnerabilities, offering them financial rewards in return. Initially, researchers could earn up to $5,000 for reporting remote code execution vulnerabilities and up to $1,000 for vulnerabilities leading to the theft of insecure private data.
In July 2019, Google, a subsidiary of Alphabet Inc. (GOOG), raised the reward amounts to $3,000 for vulnerabilities related to the theft of insecure private data and up to $20,000 for remote code execution vulnerabilities. By August 2019, the company had disbursed over $265,000 in rewards to developers through the program.
Over time, the scope of the program expanded to include developers from various high-profile companies and apps such as Facebook, Amazon (AMZN), Alibaba (BABA), Spotify, Telegram, Tesla (TSLA), Zomato, and TikTok, among others.
The email mentioned that the final reward decisions will be made by September 30, marking the official end of the program. Final payments to the researchers may take a few weeks to process.
