# HackerOne

11 Hacker News commenters recommended HackerOne and 29 criticized it, November 2025 to November 2026. It was recommended in 5 of 13 months.

**Verdict:** Researchers and companies use it for managed triage, payments and SLAs on bug reports. Common caveat: slow, scripted triage often rejects valid reports.

## Why people recommend it

- Pays bounties quickly and reliably (3 comments): "HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency." ([source](https://news.ycombinator.com/item?id=49239120)) "HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker" ([source](https://news.ycombinator.com/item?id=49243834)) "it was all processed very quickly and I got paid" ([source](https://news.ycombinator.com/item?id=49240969))
- Standard channel for reporting vulnerabilities (3 comments): "I responsibly disclosed it to Anthropic via their HackerOne bug bounty program." ([source](https://news.ycombinator.com/item?id=48917455)) "go to platforms like HackerOne and BugCrowd and do some bug bounty hunting" ([source](https://news.ycombinator.com/item?id=49721567)) "You can file a report through HackerOne" ([source](https://news.ycombinator.com/item?id=47828458))
- Triage and structure for reports (2 comments): "This is where “managed” bug bounty programs like BugCrowd or HackerOne deliver value: only telling you when there is something real." ([source](https://news.ycombinator.com/item?id=46139889)) "They make SLAs possible. They provide structure and administration." ([source](https://news.ycombinator.com/item?id=49242259))

## What people warn about

- Valid reports rejected or marked duplicate (5 comments): "they have hackerone employees pre-screen submissions and I had to tell them multiple times why my submission was valid" ([source](https://news.ycombinator.com/item?id=49247838)) "every time I've reported a complicated issue to a program on HackerOne, the triggers have completely rejected them" ([source](https://news.ycombinator.com/item?id=45835489)) "My first 3 reports were marked as duplicate. The last report on there was an auth bypass, essentially." ([source](https://news.ycombinator.com/item?id=46513391))
- Slop floods reports (3 comments): "those reports tend to come in with all sorts of flowery language added (or prompt-added) by people who don't know what they are doing" ([source](https://news.ycombinator.com/item?id=47283450)) "This already exists on the previous platform curl was using (HackerOne), it does not prevent the slop." ([source](https://news.ycombinator.com/item?id=46718785)) "with the volume of inbound reports coming from LLMs, the signal-to-noise ratio has plummeted" ([source](https://news.ycombinator.com/item?id=49241801))
- Tone-deaf, gatekeeping company leadership (4 comments): "Literally every time I've had to use a reporting procedure (like HackerOne) has resulted in tone-deaf responses from the company or complete gatekeeping." ([source](https://news.ycombinator.com/item?id=47096499)) "while the engineering product flounders is such a perfect representation of corporate rot" ([source](https://news.ycombinator.com/item?id=49238929)) "they are full steam ahead with fucking over the people that made them what they are" ([source](https://news.ycombinator.com/item?id=49244369))

## Where to get it

- [Visit the official site](https://www.hackerone.com/)

## Cite as

Hacker Approved, "HackerOne", https://hackerapproved.com/p/hackerone/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).