HackerOne
HackerOne is a cybersecurity platform that connects organizations with security researchers (ethical hackers) to help identify and remediate security vulnerabilities through bug bounty programs and penetration testing services. Its core functions include vulnerability submission and management, bounty incentive mechanisms, and security compliance reporting. It serves government agencies, technology companies, and various organizations, and is one of the primary platforms for coordinating coordinated vulnerability disclosure (CVD).
Core Facts
Representative domestic SRC platforms include Butian (operated by QiAnXin) and Vulbox, while internationally there are HackerOne and Bugcrowd.
HackerOne and Bugcrowd are currently the two largest bug bounty intermediary platforms in the world.
Timeline (last 90 days)
GitHub's bug bounty program runs on the HackerOne platform.
On most Bug Bounty platforms, rewards for vulnerability reports follow a first-come, first-served principle; if multiple people submit the same vulnerability, only the first confirmed report receives a bounty, and subsequent reports are marked as Duplicate and receive no reward.
Responsible disclosure of this vulnerability was completed by a HackerOne researcher.
Third-party aggregation platforms such as Butian, Vulnerability Box, and HackerOne uniformly manage white-hat identity verification, vulnerability acceptance standards, and bounty disbursement processes, with HackerOne targeting overseas vendors.
The srcHunter skill package recommended by the author contains 19 attack-oriented prompts, 263 payload entries, EDR-bypass content, 2,887 real vulnerability reports from HackerOne, and 88,636 historical WooYun cases.
HackerOne and Bugcrowd were both founded in 2012.
HackerOne platform data shows that as of 2023, the platform has cumulatively paid security researchers more than $300 million in bounties.
The curl project operates a bug bounty program through the HackerOne platform.
The curl project operates a bug bounty program through the HackerOne platform, and Stenberg has referred to the behavior of submitting AI-generated false vulnerability reports as "AI security washing".
Representative domestic SRC platforms include Butian (operated by QiAnXin) and Vulbox, while internationally there are HackerOne and Bugcrowd.
2 more timeline events
All Facts (17)
Representative domestic SRC platforms include Butian (operated by QiAnXin) and Vulbox, while internationally there are HackerOne and Bugcrowd.
65%VerifiedHackerOne and Bugcrowd are currently the two largest bug bounty intermediary platforms in the world.
65%Unverified美国国防部、谷歌、微软等机构均是HackerOne的客户
85%UnverifiedHackerOne成立于2012年，是目前全球规模最大、影响力最广的漏洞赏金平台之一
85%UnverifiedHackerOne的Signal评分机制会追踪研究人员的历史提交质量，低质量提交会影响其平台声誉和未来参与高价值项目的资格
85%UnverifiedThe curl project operates a bug bounty program through the HackerOne platform.
60%UnverifiedMainstream bug bounty platforms include HackerOne, Bugcrowd, and Intigriti, with participating companies spanning Google, Meta, and Microsoft.
60%UnverifiedGitHub's bug bounty program runs on the HackerOne platform.
50%UnverifiedOn most Bug Bounty platforms, rewards for vulnerability reports follow a first-come, first-served principle; if multiple people submit the same vulnerability, only the first confirmed report receives a bounty, and subsequent reports are marked as Duplicate and receive no reward.
50%UnverifiedResponsible disclosure of this vulnerability was completed by a HackerOne researcher.
50%UnverifiedThird-party aggregation platforms such as Butian, Vulnerability Box, and HackerOne uniformly manage white-hat identity verification, vulnerability acceptance standards, and bounty disbursement processes, with HackerOne targeting overseas vendors.
50%UnverifiedThe srcHunter skill package recommended by the author contains 19 attack-oriented prompts, 263 payload entries, EDR-bypass content, 2,887 real vulnerability reports from HackerOne, and 88,636 historical WooYun cases.
50%UnverifiedHackerOne and Bugcrowd were both founded in 2012.
50%UnverifiedHackerOne platform data shows that as of 2023, the platform has cumulatively paid security researchers more than $300 million in bounties.
50%UnverifiedThe curl project operates a bug bounty program through the HackerOne platform, and Stenberg has referred to the behavior of submitting AI-generated false vulnerability reports as "AI security washing".
50%Unverified漏洞报告呈现分层：约80%的报告集中在20%的常见漏洞类型上，而高价值零日漏洞越来越难发现，研究投入呈指数级增长
50%Unverified漏洞赏金平台上约80%的报告集中在20%的常见漏洞类型上
50%