in october 2013, google announced a major change to its vulnerability reward program. previously, it had been a bug bounty program covering many google products. with the shift, however, the program was broadened to include a selection of high-risk free software applications and libraries, primarily those designed for networking or for low-level operating system functionality. submissions that google found adherent to the guidelines would be eligible for rewards ranging from $500 to $3133.70. in 2017, google expanded their program to cover vulnerabilities found in applications developed by third parties and made available through the google play store.