Snapshot 256901
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Program guidelinesScopeHacktivityThanksUpdatesCollaboratorsSafe harbor Introduction Welcome! We’re thrilled that you’re considering helping to make HackerOne even stronger. We’ve always prioritized security, but we know that every technology has its flaws. Your expertise is invaluable in uncovering these bugs. If you find a security issue in our service, we’re eager to collaborate with you to resolve it and ensure you receive fair compensation for your discovery. Happy Hacking!!!!!! Program highlights Open ScopeRewards reports for all owned assets based on impact, even if not listed in scope. Fast PaymentEnsures payment within 1 month of receiving a vulnerability report. Gold Standard Safe HarborAdheres to Gold Standard Safe Harbor. AI Research Safe HarborAdheres to AI Research Safe Harbor. Platform StandardsFully compliant with Platform Standards. Coordinated Vulnerability DisclosureStandard Top Response EfficiencyThis program's response efficiency is above 90%. Signal Requirement2.0 or higher past-year Signal required, with use of trial reports for hackers below it. Managed by HackerOneCollaboration EnabledIncludes Retesting 3 hours Average time to first response 8 hours Average time to triage 2 months, 2 weeks Average time to bounty 2 months, 2 weeks Average time from submission to bounty 1 week, 1 day Average time to resolution Rewards summary Last updated on July 28, 2026. View changes Each severity lists the 90-day average bounty and the percentage of total resolved reports, if applicable. Asset Low Avg. bounty $17049.17% submissions Medium Avg. bounty $1,58638.98% submissions High Avg. bounty $7,1179.17% submissions Critical Avg. bounty $15,0002.68% submissions hackerone.com $100 – $200 $1,500 $7,000 $15,000 api.hackerone.com $100 – $200 $1,500 $7,000 $15,000 https://*.hackerone-user-content.com/ $200 — — — www.hackerone.com $200 $1,000 $3,000 $6,000 hackerone.live $200 — — — https://reviewer.pullrequest.com $200 $1,000 $5,000 $10,000 *.vpn.hackerone.net $200 $1,500 $7,000 $15,000 https://ctf.hacker101.com $200 — — — errors.hackerone.net $200 $1,000 $3,000 — https://*.hackerone-ext-content.com $200 $1,000 $3,000 — https://app.pullrequest.com $200 $1,000 $5,000 $10,000 💡 Remember Read and adhere to the program testing rules and policies. Only the test reports and programs provided for PoC demonstrations. Using additional reports does not increase severity or reward. Failure to comply with these testing requirements is likely to result in your submission being deemed ineligible for a bounty. Scope exclusions Core Ineligible Findings are out of scope. Learn more Category Exclusion details Misleading Information from Hai AI Copilot Manipulating Hai, our AI copilot, to produce misleading and false information. We continuously work to improve the accuracy of Hai’s responses but right now we accept that it will let us down sometimes. Host Header Validation and URL Path Issues Reports which target a lack of host header validation or that exploit multiple forward slashes at the root of the path segment of a URL. Both of these issues are known to both us and Cloudflare, and their resolution is outside our control. Enumeration of Claimed User and Program Handles Reports which enumerate already claimed user and program handles. This reveals no sensitive information, regardless of whether the associated profiles are public or private. Invitation Expiration Date Issues Reports relating to invitation expiration dates. Gaming Badges Functionality The ability to game the badges functionality by closing submissions reported by yourself or a team member in a verified program. Disclosure of Private Programs Most reports which disclose the existence of private programs, for example, the usage of SAML. Viewing Non-Top 100 User Ranks The ability to see a user's rank when they're not ranked in the top 100. The rank is expected to be accessible by everyone. Subdomain takeover without takeover POC Subdomain takeover without a takeover POC will be closed as NA. Handling Customer/Organization Information Disclosure Information disclosure caused by a customer/organization on HackerOne; these reports will be closed as n/a, and we encourage you to report the information disclosure to the relevant program. Single or Many Username Information Disclosure Usernames and email aliases are considered public information and would need to be paired with another attack to be exploited. Disclosure Contained Hacker’s Reports Inbox or Comments If a hacker’s inbox appears in a public report or video, it’s not a security issue. Hackers and customers should avoid sharing sensitive info. If you spot any issues in our disclosed reports, you're welcome to let us know — we’ll mark it resolved, but it's not eligible for a reward. Disclosure of Private Programs Private programs on HackerOne, as disclosed through reports, GraphQL queries, or their responses, do not impact the CIA triad and will be closed as informative. If sensitive data related to a program on HackerOne is discovered, we encourage you to report it. Each case will be reviewed individually. Integration Retroactive Sync When integrations (Linear, Slack, Jira, etc.) are re-enabled after being disabled, all activities from the disabled period sync retroactively. This is by design to maintain data consistency. Public Sitemap Enumeration (hackerone.com/sitemap) The sitemap at hackerone.com/sitemap is publicly available by design for SEO purposes. It lists public program pages and profiles that are already accessible. Reports about enumerability of this endpoint are considered informative, as the data is public and non-sensitive. This is intentional. Bypassing trial report limits or signal requirement Bypassing trial report limits or signal requirements through embedded forms is out of scope Employee Profile Scraping Scraping, enumerating, or analyzing HackerOne employee profiles (e.g., LinkedIn, GitHub, social media), including “pattern analysis,” is not eligible. Reports must focus on **technical vulnerabilities in HackerOne-owned assets**, not individuals. Internal access control to support a level playing field Reports related to security access or processes granted to a researcher exclusively by virtue of their employment or work contract with HackerOne are not eligible for bounty and are expected to be reported regardless as part of their obligations as current or former employees or contractors. ID Verification Reports related to bypassing ID Verification are out of scope Sensitive tokens exposed to our analytics/telemetry via URLs Sensitive tokens (password-reset, 2FA, verification) in URLs reaching our analytics or monitoring tools (Segment, Datadog RUM, Intercom, GA), browser history, or Referer headers are accepted risk and not bounty-eligible, unless readable by an external party without insider access. Overview Last updated on November 5, 2026. View changes 🔹 Getting Started (Setup) 🔧 Testing Requirements Required Setup and Identification Set a custom HTTP header in all testing traffic. Include the header you used in your vulnerability report so HackerOne can identify your activity and deconflict it from other testing. Identifier Type Header Format Example HackerOne username X-Bug-Bounty: HackerOne-<username> X-Bug-Bounty: HackerOne-username Tool identifier X-Bug-Bounty: <toolname> X-Bug-Bounty: BurpSuitePro Testing Rules and Policies 🔒 Handling Sensitive Information All vulnerability reports and related data must be treated as sensitive and handled accordingly. Failure to comply with these testing requirements may result in your submission being deemed ineligible for a bounty. Program Scope and Assets In Scope Issues affecting assets under HackerOne's control are in scope. This includes: Vulnerabilities affecting self-hosted assets Incorrect asset configurations Missing or incomplete security patches Other security issues within HackerOne's control Out of Scope Third-party assets outside HackerOne's control are not authorized for testing because HackerOne cannot grant permission to test infrastructure it does not host or operate. Reports affecting third-party assets will generally be closed as Informative. In exceptional cases, HackerOne may award a discretionary bonus when a report demonstrates meaningful value to HackerOne's security posture. 🧪 Testing Resources and References General Guidelines Sandbox Usage Whenever possible, perform testing within your own HackerOne sandbox organizations. You may create a sandbox program using HackerOne's program creation workflow and select any available product edition. This provides access to nearly all HackerOne features. Researchers may create up to 30 sandbox programs. Live Environment Testing When testing in a live environment, you may only test against the approved HackerOne test programs listed in this document. Approved Reports for Proofs of Concept You may only use the following approved vulnerability reports when demonstrating a proof of concept (PoC). Test Report Purpose Test Report #3863297 Approved for PoC demonstrations Test Report #3863307 Approved for PoC demonstrations Test Report #3863322 Approved for PoC demonstrations ⚠️ Source Restrictions (Bounty Eligibility) Only the approved proof-of-concept reports listed above may be used when demonstrating a vulnerability. Do not use: Reports from any other HackerOne program Reports from private customer programs Reports from any non-HackerOne source ⚠️⚠️⚠️WARNING⚠️⚠️⚠️ Using an unapproved report makes your submission ineligible for a bounty. If your submission relies on testing performed using: another HackerOne program, account, or report, not approved for testing, a customer program, or any non-HackerOne source, It may result in your submission being deemed ineligible for a bounty. Using multiple approved proof-of-concept reports to demonstrate the same issue does not increase the severity or reward of a finding. Scope Restrictions Do not access or test: Customer programs Customer environments Customer data Data Handling If you inadvertently obtain sensitive information during testing: Stop testing immediately. Contact HackerOne. Delete the information from all local and stored systems. HackerOne may request confirmation that the data has been deleted. HackerOne may also request the usernames, IP addresses, or other identifiers used during testing to assess potential impact. 📋 Program State Testing Program States HackerOne supports six program states that are relevant to testing: Sandbox Invite-only Public External program External program + Sandbox External program + Invite-only A valid vulnerability exists when there is an unauthorized or security-relevant difference between the behavior of Sandbox and Invite-only programs. It is not a vulnerability if a researcher cannot distinguish a Sandbox program from an Invite-only program. Use the following approved programs for testing. Test Programs Program State Program Handle ID Node ID Sandbox @security-test-sandbox 49806 Z2lkOi8vaGFja2Vyb25lL1RlYW0vNDk4MDY= Invite-only @security-test-invite-only 49807 Z2lkOi8vaGFja2Vyb25lL1RlYW0vNDk4MDc= Public @security 13 Z2lkOi8vaGFja2Vyb25lL1RlYW0vMTM= External program @security-test-ep 49803 Z2lkOi8vaGFja2Vyb25lL1RlYW0vNDk4MDM= External program + Sandbox @security-test-ep-sandbox 49804 Z2lkOi8vaGFja2Vyb25lL1RlYW0vNDk4MDQ= External program + Invite-only @security-test-ep-invite-only 49805 Z2lkOi8vaGFja2Vyb25lL1RlYW0vNDk4MDU= Test Objects for Proofs of Concept You may use the following object identifiers when creating proofs of concept on hackerone.com. Object Type ID GraphQL ID Purpose StructuredScope 58579 Z2lkOi8vaGFja2Vyb25lL1N0cnVjdHVyZWRTY29wZS81ODU3OQ== Asset belonging to @security-test-sandbox StructuredScope 100578 Z2lkOi8vaGFja2Vyb25lL1N0cnVjdHVyZWRTY29wZS8xMDA1Nzg= Asset belonging to @security-test-invite-only 🚫 Denial-of-Service (DoS) Policy Dos Rules Overview Requirement Policy Request constraints Single request, single user, and single source IP only Automation Automated tools, scripts, bots, and high-volume attacks are prohibited Testing window Monday–Thursday, 9:00 PM UTC–6:00 AM UTC Safety brake Stop immediately if service degradation is detected Audit information Include the source IP address and timezone used during testing Cache poisoning Evaluated on a case-by-case basis based on demonstrated impact DoS Reward Eligible Denial of Service (DoS) findings are capped at the Medium severity bounty rate for the affected asset. Asset Bounty www.hackerone.com $1,000 hackerone.com $1,500 Reports that include prohibited testing methods or actions are not eligible for a reward. DoS Eligibility To qualify for a DoS reward, a finding must demonstrate measurable degradation of HackerOne's servers or infrastructure, such as: Increased response times Service unavailability Resource exhaustion affecting HackerOne systems DoS Testing Guidelines ✅ DoS Allowed Single-user, realistic actions only Begin gradually with one or two requests Send testing traffic from a single source IP Validate observed impact from a separate IP Stop immediately once service degradation is detected ❌ DoS Prohibited Distributed denial-of-service (DDoS) attacks Testing from multiple attacking IPs Automated tools, scripts, or bots Resource-exhaustion attacks Data corruption or manipulation Actions that compromise data integrity Top hackers See all hackers 1 haxta4ok00 Reputation: 1k 2 h13- Reputation: 1k 3 japz Reputation: 1k 4 0v3rw4tch Reputation: 675 5 errorsec_ Reputation: 554 6 n1had Reputation: 410 7 syn-l1ack Reputation: 408 8 7odamoo Reputation: 289 9 n3s7l3 Reputation: 288 10 r3y Reputation: 288 11 danlec Reputation: 275 12 akashhamal0x01 Reputation: 263 HackerOne https://hackerone.com@Hacker0x01 Vulnerability disclosure should be safe, transparent, and rewarding.Bounty launched in Nov 2013 Response efficiency: 100% Submit without Report Assistant Rewards Severity Rewards Low Avg. bounty $17049.17% submissions $100 – $200 Medium Avg. bounty $1,58638.98% submissions $1,000 – $1,500 High Avg. bounty $7,1179.17% submissions $3,000 – $7,000 Critical Avg. bounty $15,0002.68% submissions $6,000 – $15,000 Stats Total bounties paid $2,127,333 Average bounty $500 Top bounty range $2,500 - $25,000 Bounties paid | 90 days $65,469 Reports received | 90 days 1091 Last report resolved 6 days ago Reports resolved 1043 Hackers thanked 919 Assets In Scope 26 © HackerOne Opportunities Security Leaderboard Blog Status Docs Support Disclosure Guidelines Press Privacy Terms