Biggest change here is that it's becoming so hard to find bugs on Google-owned domains that they're starting to pay speculative bounties (before you've found an

Biggest change here is that it's becoming so hard to find bugs on Google-owned domains that they're starting to pay speculative bounties (before you've found anything). I'd really like to see how many bounties they paid out for "security improvements" bounties that they announced middle of 2014. Those were proactive software development bounties to make code more amenable to static analysis, new exploit mitigations, etc.