HackerOne
The largest program catalog - web, mobile, API, and increasingly AI/LLM scope. The default first stop for most hunters.
Tags: public, vdp, reputation, hacktivity
- Program model
- Bounty · VDP · Pentest
- Regions
- Global
- Payout
- USD via PayPal / Coinbase / bank; per-program bounty tables
Specialties: web, api, mobile, ai/llm
How to approach it
Reputation / Signal / Impact stats gate private invites. Start on VDPs (no bounty) to build stats, then get invited to paid private programs.
What the platform publishes
HackerOne publishes a Gold Standard Safe Harbor. Where a program adopts it, good-faith research that follows that program's guidelines is authorized: the organization says it will not bring a legal claim for that research, including for bypassing a technical measure used to protect an in-scope application, and it waives conflicting terms that would forbid that research. Disclosure is a program setting. On the default for verified programs, a resolved report can be disclosed, and it is disclosed after 30 days if the request is neither approved nor denied. Other states need both sides to agree. The severity string on a disclosed report is that report's label.
- Read Hacktivity (hackerone.com/hacktivity) daily - disclosed reports are the best free methodology source.
- Keep Signal high: low-quality/dupe reports hurt your invite chances more than no reports.
- Filter the directory by 'new programs' - fresh scope has the least-picked-over bugs.