Policy and restrictions
Do not access customer programs, environments or data, or unauthorized third-party infrastructure. Encountering sensitive information requires stopping and notifying the program.
Eligibility and submission status
Program compliance is required for reward eligibility. Employment-exclusive findings and unapproved report sources can be ineligible.
An enabled submission link and no pause notice were observed, but submission acceptance was not tested or explicitly stated.
Advertised rewards
Advertised ranges: Low $100–$200; Medium $1,000–$1,500; High $3,000–$7,000; Critical $6,000–$15,000.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
hackerone.com | URL | Bounty eligible: Yes |
api.hackerone.com | URL | Bounty eligible: Yes |
www.hackerone.com | URL | Bounty eligible: Yes |
app.pullrequest.com | URL | Bounty eligible: Yes |
reviewer.pullrequest.com | URL | Bounty eligible: Yes |
hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com | URL | Bounty eligible: Yes |
www.wearehackerone.com | URL | Bounty eligible: Yes |
mta-sts.wearehackerone.com | URL | Bounty eligible: Yes |
errors.hackerone.net | URL | Bounty eligible: Yes |
https://*.hackerone-ext-content.com | URL | Bounty eligible: Yes |
a5s.hackerone-ext-content.com | URL | Bounty eligible: Yes |
b5s.hackerone-ext-content.com | URL | Bounty eligible: Yes |
hackerone-ext-content.com | URL | Bounty eligible: Yes |
https://*.hackerone-user-content.com/ | URL | Bounty eligible: Yes |
ctf.hacker101.com | URL | Bounty eligible: Yes |
hackathon-photos.hackerone-user-content.com | URL | Bounty eligible: Yes |
cover-photos.hackerone-user-content.com | URL | Bounty eligible: Yes |
hackathon-photos-us-east-2.hackerone-user-content.com | URL | Bounty eligible: Yes |
profile-photos.hackerone-user-content.com | URL | Bounty eligible: Yes |
hackerone-user-content.com | URL | Bounty eligible: Yes |
profile-photos-us-east-2.hackerone-user-content.com | URL | Bounty eligible: Yes |
cover-photos-us-east-2.hackerone-user-content.com | URL | Bounty eligible: Yes |
hackerone.live | URL | Bounty eligible: Yes |
*.vpn.hackerone.net | OTHER | Bounty eligible: Yes |
https://hackerone.com/mcp | OTHER | Bounty eligible: Yes |
https://github.com/Hacker0x01/react-datepicker | OTHER | Bounty eligible: No |
| Asset | Type | Group / eligibility |
|---|---|---|
support.hackerone.com | URL | Bounty eligible: No |
go.hacker.one | URL | Bounty eligible: No |
info.hacker.one | URL | Bounty eligible: No |
ma.hacker.one | URL | Bounty eligible: No |
h1.community | URL | Bounty eligible: No |
www.h1.community | URL | Bounty eligible: No |
www.hackeronestatus.com | URL | Bounty eligible: No |
hackerone-swag.com | URL | Bounty eligible: No |
Review limitations
- Policy and reward table were reviewed in the browser; static retrieval returned a JavaScript placeholder.
- The page displays policy update September 24, 2026 and reward-table update July 28, 2026.
- Only dollar signs appear; ISO currency and normalized bounds remain null. Requirements are not exhaustively reproduced.
Sources and provenance
- HackerOne Security Bounty | Bounty Policy | HackerOne HackerOne / HackerOne · reviewed 2026-10-02
- Published HackerOne structured scope HackerOne · reviewed 2026-10-03
Record reviewed 2026-10-02. Snapshot 53796974ace8. Open the complete JSON contract.