Reports on non-eligible device versions

The Android platform has new security features in each release, so bugs that are exploitable on older devices are not always exploitable on newer ones. Only bugs that are exploitable on Android 5.0 or later are eligible for VRP. If you don't have a 5.0 device, it's okay to test your bugs on an older device, but be aware they might not be eligible if they don't affect later devices.

A diversity of Android devices are available, and many of them contain code and features that are provided by the original equipment manufacturer (OEM) that makes the device. If a bug in an app can only be exploited due to OEM code on a non-Nexus device, it is not eligible. You are encouraged to report it to the OEM that makes the device though!