Google paid $90,000 for a DevSite RCE bug, then took two months to patch it

Engineer Simon Köck found an unauthenticated RCE in Google's DevSite infrastructure: a reused OAuth client secret signed Flask session cookies, and pickle deserialization allowed code execution. Google rated it S0 and paid a $90,000 bounty, but the fix only shipped on October 7, two months after the report.

• The flaw affected seven Google domains; only developers.google.com was publicly confirmed
• The OAuth secret doubled as the Flask session-signing key stored in the cookie
• $90,000 payout: $75,000 base for an S0 RCE plus a 1.2x quality multiplier
• Reported August 6, bounty approved August 27, fix deployed October 7