Google stopped taking product vulnerability reports to its open source bug bounty on October 1, citing a surge of mostly invalid automated submissions. Supply chain…