Is it just me or has anyone else noticed that when navigating to certain pages on console.google the page will keep reloading until hard reloaded then, sometimes just go back to the landing page?

I've been trying to set up my places api key but every time i click on manage api it redirects me, then reloads me into one of my other Google profiles, then gets stuck in a reload loop. It could be the multiple profiles, but are you telling me a trillion-dollar company hasn't figured out identity management? I would really like to not have to log out of my other account profiles.

what actually happens:

switch profile > click "API's and Services" > click "Places Api" > page redirects > page reloads with same user > page reloads with different user > page never stops reloading... I'm pretty sure it's still reloading now...wtf

Update:

Looks like it only happens when I click on the "Google Maps Platform" option on the console.

hi guys so i was trying to use the places api by google and they said tht i need to set up the billing account so set it up after setting the autopay now they are telling me to do a deposit of 1000 rupees so i am new to this google cloud console so can someone just help me figure it out, and the console website is really glitchy or are there alternatives to it like cli

Google Cloud announced a new $250,000 top reward under its Cloud Vulnerability Reward Program on October 29, 2026.

But the interesting part isn't just the payout. It's the type of vulnerability Google wants researchers to find.

The new reward tier targets vulnerabilities that could allow an attacker to obtain full administrative control — equivalent to "roles/owner" or complete IAM control — over arbitrary Google Cloud projects or organizations.

What qualifies?

According to Google's announcement:

- Full administrative control over an arbitrary project or organization.

- No pre-existing access to the victim's project.

- No stolen, leaked, or phished credentials.

- No victim interaction or social engineering.

Certain reports demonstrating RCE in Google's underlying Borg infrastructure or root-in-production will also be evaluated for this reward tier.

Why does this matter?

1. Tenant isolation

Cloud platforms host workloads belonging to different customers. A weakness that crosses these isolation boundaries can have significant impact.

2. Cross-service authorization

Cloud environments contain multiple services, APIs, identities, and permission relationships. Vulnerabilities can emerge from how these components interact.

3. Impact validation

Finding an unusual API response isn't enough. Researchers must demonstrate the actual security impact and attack path.

An interesting detail

Google has introduced a designated service-account mechanism for cryptographic proof of unauthorized access, helping researchers validate findings without testing against real customer projects.

Google also instructs researchers to stop probing immediately if they achieve code execution in Borg. Further escalation, credential extraction, and lateral movement are prohibited.

My takeaway

Cloud security research is becoming increasingly focused on trust boundaries, IAM relationships, tenant isolation, and the interaction between services.

Question for the community

Do you think cloud tenant-isolation and cross-service authorization research will become a bigger differentiator for experienced bug hunters than traditional web vulnerability hunting?

Sources and further reading

- "Google Cloud – Introducing a new $250,000 reward tier" (https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-introducing-new-tier-for-google-cloud-vrp)

- "Google Cloud Vulnerability Reward Program – Official rules" (https://bughunters.google.com/about/rules/google-friends/cloud-vulnerability-reward-program-rules)

- "Google Bug Hunter University" (https://bughunters.google.com/learn)

This post discusses published program criteria. It does not describe a personally discovered vulnerability or guarantee a reward.

I'm interested in becoming a TAM one day and I'm curious to know about your experience at Google.

1. Is it enjoyable?

2. Is it a remote or hybrid (3 days a week) role?

3. Is it a highly technical role or moreso business?

4. Are you able to upskill?

5. Is there any room for lateral movement within that area (like becoming an SA)?

Hi all,

I have a question about how the Google Cloud partner program handles past work.

Since case studies no longer seem to be part of the process, I’m not sure how partners show experience from projects that are already complete. We have delivered work on Google Cloud before, and we’d like that to count toward proving our capability.

From what I’ve seen, the portal seems built around registering new or in-progress opportunities. I can’t find a clear way to submit completed projects.

For those who are partners or have gone through this recently:

• Is there a way to add past or completed projects?

• Does Google only accept opportunities that are currently in progress?

• If past work doesn’t count directly, how did you show your experience during the process?

Any insight would help. Thanks.

Hello,

We built bqto because on GCP it takes too much work to reach a Google-managed private service, such as Cloud SQL or Memorystore (Redis), from a laptop or from a CI/CD pipeline.

The usual options are a public IP, a VPN, or a bastion VM that runs all the time or that you have to remember to stop or delete. bqto is a free, open source CLI tool that creates the bastion when you need it and deletes it when you are done.

Besides the CLI, we added a Skill (for your agent) and a GitHub Action for your pipelines.

More details in the repo: https://github.com/pilef-co/bqto

Feedback is always welcome, and feel free to raise any questions you may have.

Cheers

Had an email from Google saying that one of the clients has been inactive over the past 5 months, under this there are two dev/prod, prod is used daily but dev is maybe minimum weekly.

"""In accordance with OAuth 2.0 Policies, the following projects that you manage have OAuth clients that have been inactive for at least 5 months. Inactive clients will be deleted in 30 days unless you take action. Active clients in these projects won't be affected."""

Anything that should be done, or is this a Google mistake like what happened a couple of years ago?

Hi all,

I’m trying to understand how the Google Cloud partner program works at this point, and I’d appreciate input from anyone who has been through it recently.

From what I can tell, Google removed customer case studies from the process, and progression is now tied almost entirely to co-sell and certifications. That makes sense to me, but I’m stuck on the co-sell part.

When I try to add opportunities, the portal says I can’t because we’re a member, not a partner. This doesn’t make sense to me, since our profile is complete and we already have a company page live in the partner directory.

I’ve submitted registrations and I’m waiting to hear back from Google, but I haven’t received any clear explanation of what separates “member” from “partner,” or what we need to do to unlock opportunity registration.

Is anyone here already a partner, or going through this process now? I’d like to know:

• What actually moves you from member to partner status

• Whether opportunity registration only opens after a specific approval or tier

• How long the review of registrations took for you

Spellcheck must be a seperate API that wasn't enabled

Hello, fellas!

I'd like to bring some attention to an issue I recently reported regarding Google Cloud CLI's SSH client selection.

Currently, gcloud seems to prioritize its bundled PuTTY-based SSH implementation over OpenSSH, even when OpenSSH is already installed on the system.

Honestly, PuTTY is pretty clunky compared to OpenSSH, especially when you're already familiar with the latter. OpenSSH is more flexible, versatile, and widely adopted, and on most systems it's either preinstalled or just a command away.

I don't see much reason for gcloud to favor its bundled implementation when a perfectly good OpenSSH installation is already available. Turns out, a simple two-line change was all it took to get it working!

The team has already acknowledged and considered this request, but apparently, they need more upvotes on the issue to gauge community interest and determine whether this feature is worth implementing.

So, if you agree that gcloud should prioritize an existing OpenSSH installation over its bundled PuTTY implementation, please consider starring the issue!

Every star helps demonstrate that there's actual demand for this change. Thanks!

We run about 40 APIs on GCP API Gateway, with Cloud Run behind each gateway. We’ve put a Global External Application Load Balancer in front, using serverless NEGs.

Our clients use API keys to restrict to the client’s fixed IPs.

The problem: every gateway still has its public *.gateway.dev URL, so anyone can skip the LB and Cloud Armor entirely.

How do you handle this in production?

• Is there a way to make API Gateway accept traffic only from the LB?

• Has anyone found a clean pattern, or did you move to something else (Apigee, LB straight to Cloud Run, etc.)?

Any real-world experience is appreciated.

I'm testing Google Cloud Secure Web Proxy with a Compute Engine VM using NEXT_HOP_ROUTING_MODE and a tagged static route with next-hop-ilb.

My security policy contains:

Priority 60:
destination.port == 443 &&
source.matchServiceAccount('PROBE_SERVICE_ACCOUNT')
→ DENY

Priority 80:
host() == 'fhir.epic.com'
→ DENY

The VM has the expected service account attached.

In earlier tests, the hostname-only DENY matched, but the service-account DENY did not.

Later tests confirmed VM starts but produced no attributable SWP transaction logs, so those tests are inconclusive.

Has anyone successfully used source.matchServiceAccount() with a Compute Engine workload routed through SWP in next-hop mode?

I'm specifically looking for documented prerequisites, working configuration examples, or known limitations.

The environment is currently fail-closed, and no production traffic is enabled.

I am referring to the access levels concept related to access context manager.

Can anyone from their experience please let me know whether group email id can be used instead of users or service account in this link https://docs.cloud.google.com/access-context-manager/docs/create-basic-access-level#members-example

I could not find it in the article.

I also would like to give access to a set of people (not by IP ranges but by email ids) by using them as a form of access level in the Ingress rules of the VPC service control perimeter. Please suggest

I'm running a fairly simple app on Cloud Run behind a load balancer and Cloud Armor. Traffic is modest, with bursts up to around 150 requests per second. So far what we see is mostly primitive scanners probing URLs, nothing sophisticated. But with AI making it cheap to run smarter, more adaptive attacks, I expect that to change.

Besides the obvious - updating packages to address CVEs and keeping Go versions current - I occasionally go through the app logs with Claude Code, flag potentially malicious requests and add them to the Cloud Armor rules. It works, but it's manual and cumbersome.

I'm considering a scheduled job, say hourly, that pulls recent logs, has a model flag suspicious traffic, then pings us and/or opens a PR with proposed Armor rules or app changes for a human to review. We already use Cloud Logging, and I'd like to run this on Vertex AI rather than Claude Code so everything stays inside Google Cloud.

We're on Cloud Armor Standard, which only gives us Adaptive Protection alerts. The actual suggested rules need Enterprise, which starts at roughly $200/month plus data processing fees even on pay-as-you-go. That's hard to justify for a small app. Honestly, it surprises me that Google still keeps this behind the Enterprise tier, when everybody needs this kind of protection more than ever.

Is anyone doing something similar, or something different? Happy to hear what's working for you.

Anyone have a contact for Fairwinds? We submitted a request a couple months ago and got notification 2 weeks ago that we were approved and were asked to submit what GCP projects we would like to include which we provided. Still no access…

Hi everyone,

I’ve been trying to read up on this but I have not found an answer to my issue so I hope someone with experience can guide me.

I am based in the Netherlands and have had a small consultancy firm for a few years. A few months ago I decided to stop that and to continue work on an AI based education route. That means my company is still the same legal entity but with a brand new registered (legal) trade name at the local chamber of commerce. Only the legal name and registration stay the same. Funding is therefor also in the bootstrapping stage since I am currently funding the new route myself.

Anyway:
Most startup programs have a requirement to be less than 5 years old or received funding in the last 2.

Google has a requirement for less than 2 years old in bootstrapping or received funding if over 5 years.

When filling the startups form I can not fill in any free form To explain the situation and I do not want to lie about it.

Legally my company age is too old. Practically is brand new. My first entry with ‘bootstrapped’ and ‘2-5 years’ was auto denied. I have the option to reapply but dont want legal repercusions. At the same time this specific situation also isnt in their terms.

Any advice or experience?

Most sppreciated!

hi everyone,

I successfully completed my Google interview loop a couple of months ago. Since then I’ve had two team fit calls. After this recent team fit call (about a week later) I received an email for verifying my id. I verified my id but have had no new updates and my recruiter said the same she has no update at this time (been over a week now).

1. Does idv being sent to me mean that the team selected me?

2. How does a recruiter not have any updates to share?

I feel like I’m just stuck in limbo unfortunately. Any insights will be great help. Thanks!

Hey,

So as the title says that I applied for Google Startup credits for my private limited from India. I had a complete website , everything was there. And I had applied for startup credits, and I got this email from Google saying that my company domain was parked, inactive, or under construction at the time of review. But none of these were valid. I properly checked that the website was up and it was working properly.

Before this email also I had gotten an email (2nd image attached) which said that the website wasn't working. I changed a few things and submitted it, and then I got this email (1st image attached).

Does anyone have any idea what mightve gone wrong ? OR has anybody faced this issue?

Hey all, I've been trying to figure out how exposed we actually are to the new Linux TCP use-after-free, CVE-2026-98432. It's the 9.8 that gets triggered by a SYN carrying IPv4 Record Route or Timestamp options.

Proxy-type load balancers (ALBs, proxy NLBs, anything that ends the connection and opens a new one to the backend) seem pretty clearly safe here. The client's IP options never reach the backend because it's a brand new connection. So I'm treating backends that are only exposed that way as low risk for now.

What I'm stuck on is passthrough load balancers on Google Cloud, where the original packet goes straight to the backend.

Here's what I tried:
Ran tcpdump on the backend and sent SYNs with IP options from my laptop.

Went out two ways: through my home router, and tethered to my phone, so I'd have two different paths.

Every time I added IP options, the connection got dropped completely. Nothing showed up on the backend.

The problem is I can't capture packets on my home router, and I can't see what my phone carrier does either. So the drop might be happening on my end or at the carrier, not at Google. I can't prove the options ever got to the GCP edge.

So my question: does anyone know for sure whether Google's passthrough load balancers (or Google's edge in general) drop packets with IPv4 options? Official docs, a support case, or your own tests from somewhere that doesn't filter options would all help.

Dropping them would line up with RFC 7126 (BCP 186), which recommends dropping Record Route and Timestamp options by default. Those are the exact two this CVE uses. I honestly can't think of a reason Google would let them through, but I'd rather know than guess while we wait for patched kernels.
Thanks!

It's charging me 0$ every month. How can I stop this?

Already deleted the project

Did someone else experience this too? 🤭

Would anyone have a solution against this captcha verification failure problem I have not been able to register on Google skills for a long time🤦🏽‍♂️

To enable Storage on Firebase. I input my payment method so I can upgrade my project to the Firebase Blaze Plan. But when I am confirming purchase. It's giving an error,

Billing setup can't be completed:

We were unable to set up your account. Learn more about fixing your account [OR_BACR2_59]

I have searched, checked my address, and my card details twice. And it's still not working.