Google has extended their program of paying for some bug reports.
The new program is for security bugs on select web applications.
They include google.com, blogger.com, orkut.com, and youtube.com.

There is a list of exclusions.
Do not attempt to cause a denial of service bug.

http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html