HackerOne
Bug bounty platform in Privacy & security
Researchers and companies use it for managed triage, payments and SLAs on bug reports. Common caveat: slow, scripted triage often rejects valid reports.
Researchers and companies use it for managed triage, payments and SLAs on bug reports. Common caveat: slow, scripted triage often rejects valid reports.
40 people gave an opinion
- recommend it
- 11
- criticize it
- 29
- approval share
- 28%
Recommended in 5 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 11 people recommend itNeeds 10 or more, met.
- 0.3 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Pays bounties quickly and reliably
“HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency.”
Comment from 10 Aug 2026 in “What Happened to HackerOne?” “HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker”
Comment from 10 Aug 2026 in “What Happened to HackerOne?” “it was all processed very quickly and I got paid”
Comment from 10 Aug 2026 in “What Happened to HackerOne?” Standard channel for reporting vulnerabilities
“I responsibly disclosed it to Anthropic via their HackerOne bug bounty program.”
Comment from 15 Jul 2026 in “I tricked Claude into leaking your deepest, darkest secrets” “go to platforms like HackerOne and BugCrowd and do some bug bounty hunting”
Comment from 16 Sep 2026 in “Started Learning Pentesting” “You can file a report through HackerOne”
Comment from 19 Apr 2026 in “Banned by Anthropic” Triage and structure for reports
“This is where “managed” bug bounty programs like BugCrowd or HackerOne deliver value: only telling you when there is something real.”
Comment from 3 Dec 2025 in “Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files” “They make SLAs possible. They provide structure and administration.”
Comment from 10 Aug 2026 in “What Happened to HackerOne?”
What people warn about
Each mark is one comment
Valid reports rejected or marked duplicate
“they have hackerone employees pre-screen submissions and I had to tell them multiple times why my submission was valid”
Comment from 10 Aug 2026 in “What Happened to HackerOne?” “every time I've reported a complicated issue to a program on HackerOne, the triggers have completely rejected them”
Comment from 6 Nov 2025 in “AI Slop vs. OSS Security” “My first 3 reports were marked as duplicate. The last report on there was an auth bypass, essentially.”
Comment from 6 Jan 2026 in “Tell HN: Internet Bug Bounty (IBB) on HackerOne Appears Dead, CVEs Unpaid” - Comment from 10 Aug 2026 in “What Happened to HackerOne?”
- Comment from 10 Aug 2026 in “What Happened to HackerOne?”
Slop floods reports
“those reports tend to come in with all sorts of flowery language added (or prompt-added) by people who don't know what they are doing”
Comment from 7 Mar 2026 in “Hardening Firefox with Anthropic's Red Team” “This already exists on the previous platform curl was using (HackerOne), it does not prevent the slop.”
Comment from 22 Jan 2026 in “We will ban you and ridicule you in public if you waste our time on crap reports” “with the volume of inbound reports coming from LLMs, the signal-to-noise ratio has plummeted”
Comment from 10 Aug 2026 in “What Happened to HackerOne?” Tone-deaf, gatekeeping company leadership
“Literally every time I've had to use a reporting procedure (like HackerOne) has resulted in tone-deaf responses from the company or complete gatekeeping.”
Comment from 21 Feb 2026 in “I found a Vulnerability. They found a Lawyer” “while the engineering product flounders is such a perfect representation of corporate rot”
Comment from 10 Aug 2026 in “What Happened to HackerOne?” “they are full steam ahead with fucking over the people that made them what they are”
Comment from 10 Aug 2026 in “What Happened to HackerOne?” - Comment from 10 Aug 2026 in “What Happened to HackerOne?”
What people said
40 of the 43 comments that mention it, newest first. Each links to the original comment.
“they said I would have to 'prove' that it leads to catastrophic failure”
“go to platforms like HackerOne and BugCrowd and do some bug bounty hunting”
“a good statement of a durable problem one can 'solve' profitably”
“they'll turn a blind enough eye to anyone who says they're from a different one”
“they have hackerone employees pre-screen submissions and I had to tell them multiple times why my submission was valid”
“they are full steam ahead with fucking over the people that made them what they are”
“HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker”
“It's because of the CEO: Kara Sprague.”
“H1 has probably one of the most incompetent series of CEO's in SV startup history”
“Yet I still find it next to impossible to get issues resolved.”
“They make SLAs possible. They provide structure and administration.”
“Not with HackerOne thought.”
“with the volume of inbound reports coming from LLMs, the signal-to-noise ratio has plummeted”
“My largest problem with H1 is how braindead scripted/AI their triage is.”
“They have quality data to build an effective AI pentest product that is good enough”
“it was all processed very quickly and I got paid”
“tried incite me to commit a crime against them by DoS'ing their servers”
“they didn't tell me I was rejected until I emailed them about a week later”
“the reports became all garbage”
“notably the in-house AI security product is trained on existing bug bounty reports”
“HackerOne provides real, tangible value in not making people think about how precisely to pay a hacker and in what currency.”
“while the engineering product flounders is such a perfect representation of corporate rot”
“which wouldn’t let me log in because the Cloudflare CAPTCHA HackerOne uses seems to be broken”
“I responsibly disclosed it to Anthropic via their HackerOne bug bounty program.”
“As someone on the company response side of the HackerOne brokenness”
“I have found (c) to be high noise, low signal.”
“You can file a report through HackerOne”
“those reports tend to come in with all sorts of flowery language added (or prompt-added) by people who don't know what they are doing”
“Literally every time I've had to use a reporting procedure (like HackerOne) has resulted in tone-deaf responses from the company or complete gatekeeping.”
“HackerOne feels like a honeypot to waste hackers' time.”
“they're still $8K+ per test and require weeks of coordination”
“This already exists on the previous platform curl was using (HackerOne), it does not prevent the slop.”
“I don't understand why they are not taking advantage of this.”
“a lot of companies have this set up and it's not great”
“It was fruitless. Daniel's social media posts and blog make that clear.”
“Sites like HackerOne have a triage team that's supposed to filter through the garbage, before it gets to program management.”
“My first 3 reports were marked as duplicate. The last report on there was an auth bypass, essentially.”
“They were rejected because the software was working as intended”
“This is where “managed” bug bounty programs like BugCrowd or HackerOne deliver value: only telling you when there is something real.”
“every time I've reported a complicated issue to a program on HackerOne, the triggers have completely rejected them”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.