Google's bughunters repository publishes the reference data behind bughunters.google.com, giving authorized researchers domain tiers, OSS repository tiers, and rewarded patch examples in one machine-readable place.
| Tool | google/bughunters — reference resources for Google's vulnerability reward programs, including domain tiers and OSS repository tier lists |
| Category | Documentation / curated security research resources |
| Primary Use | Consulting domain-tiers, oss-repository-tier lists, and patch-rewards-program examples when planning authorized research under Google's VRP programs |
| Safe Use | Purely educational reference material for researchers participating in authorized, sanctioned bug bounty and patch reward programs |
| Telemetry Note | A static documentation repository — it executes nothing and leaves no footprint; it only informs how researchers interact with Google's in-scope programs |
google/bughunters is not a scanner, a proxy, or an exploitation framework — it is something rarer and arguably more useful at the planning stage of an engagement: the published reference corpus behind bughunters.google.com, Google's umbrella site for its vulnerability reward programs. The repository, released under an Apache-2.0 license and sitting at a modest but growing 311 stars, packages three distinct bodies of knowledge: the Google VRP domain tier list, the OSS VRP repository tier list, and the Patch Rewards Program archive of rewarded patches. For a researcher preparing authorized work against in-scope targets, this is the difference between guessing scope and knowing it.
The most operationally significant artifact is the domain-tiers/README.md file. Google's main VRP has long structured its payouts around tiered scope, and this file exposes that tiering as plain data inside the repository. The practical value is twofold: it lets you prioritize targets where reward potential matches your effort, and it removes ambiguity about what is genuinely in scope before you touch anything. In an authorized workflow, scope discipline is not a nicety — it is the line between sanctioned research and unauthorized access, and having the tier data in a versioned git repository means you can diff it over time to see how Google's priorities shift.
The second pillar, oss-repository-tier/README.md, serves the OSS VRP, Google's program covering its own open-source projects. The tier list here is effectively a ranked attack-surface map of Google's OSS estate: repositories placed in higher tiers signal both higher perceived risk and higher reward ceilings. What makes this interesting from an analysis perspective is the meta-signal — tier assignments encode Google's own internal judgment about which of its open-source components matter most from a security standpoint, which is exactly the prioritization data a defensive engineer maintaining dependencies on those same components would also want.
The third section, patch-rewards-program/rewarded-patches/, is the part most worth studying and the least like anything else in this space. Rather than rewarding vulnerability reports, the Patch Rewards Program compensates proactive security improvements to open-source code, and this folder archives examples of patches that were actually rewarded. Read as a corpus, these examples function as annotated specimens of what "good" looks like: the class of hardening change, the depth of fix, and the framing that turned a code change into a compensated contribution. For anyone preparing a submission, studying accepted precedents is the most reliable signal available about the program's real bar.
Architecturally, the repository is refreshingly transparent about how it stays current. The bughunters folder is documented as a straight copy of the public website content, synchronized on a weekly cadence via Google's internal copybara tooling — the README even surfaces the migration command, copybara migrate security/vrp/oss/repositories/external/copy.bara.sky repositories_to_github, for maintainers who need to force a refresh. This tells you two things: the content is derivative of the canonical website rather than the source of truth, and a several-day staleness window is expected behavior, not a defect. Always cross-check the live site before acting on scope decisions.
The automation angle deserves emphasis. Because everything here is markdown under git, the tiers and lists are trivially consumable by scripts: a CI job can watch the repository, diff domain-tiers/README.md against the previous revision, and alert when a target you research moves tiers — which is simultaneously a reward-opportunity signal for hunters and a scope-change signal for defenders tracking what Google considers high-value surface. That dual utility is the quiet strength of publishing program data as a repository rather than as a set of web pages.
Two caveats from the README itself are worth internalizing. First, the explicit disclaimer that this is not an official Google product — despite living under the google organization — sets expectations about support and authority. Second, the weekly sync cadence means the repo can lag behind policy changes at bughunters.google.com, which matters when payout tables or scope rules shift. Neither caveat undermines the value; both just define the correct trust model, where the repository is a convenient mirror and the website remains authoritative.
From a defensive perspective, there is real merit in blue teams reading this repository even if they never intend to file a report. The domain-tiers and oss-repository-tier structures communicate how a very mature security organization triages and prices risk across a sprawling estate, which is a useful template for internal bug bounty scoping and for vulnerability management prioritization more broadly. The rewarded patch archive doubles as training material for engineers learning to recognize and write meaningful hardening patches rather than point fixes.
The obvious limitations are those of any documentation repository: there is no code to run, no installation beyond git clone https://github.com/google/bughunters, and no versioned releases or language metadata to speak of. Judged as software it is trivial; judged as an intelligence product it is consistently useful. The right mental model is a continuously synced, diffable policy feed from one of the industry's largest VRP operators.
Where bughunters fits in an authorized workflow is squarely at the front end: target selection, scope verification, reward optimization, and submission-craft study, all before any testing begins. Paired with the live rules at bughunters.google.com, it collapses the research that used to require scraping forum posts and stale blog writeups into a single clonable reference. For professionals who treat bug hunting as a disciplined practice rather than opportunistic probing, this repository is a cheap, permanent fixture in the toolkit.
google/bughunters.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.