HackerOne
HackerOne is a cybersecurity platform that connects organizations with security researchers (ethical hackers) to help identify and remediate security vulnerabilities through bug bounty programs and penetration testing services. Its core functions include vulnerability submission and management, bounty incentive mechanisms, and security compliance reporting. It serves government agencies, technology companies, and various organizations, and is one of the primary platforms for coordinating coordinated vulnerability disclosure (CVD).
Core Facts
Representative domestic SRC platforms include Butian (operated by QiAnXin) and Vulbox, while internationally there are HackerOne and Bugcrowd.
Bug bounty programs are hosted on platforms such as HackerOne and Bugcrowd, where companies incentivize white-hat hackers to discover vulnerabilities by offering monetary rewards.
HackerOne and Bugcrowd are currently the two largest bug bounty intermediary platforms in the world.
Timeline (last 90 days)
The Omarchy team has appointed a security lead and a security team, and runs a $100,000 bug bounty program on HackerOne.
Domestic SRCs are mostly built by enterprises themselves, with considerable variation in rules, and their requirements for report format and reproduction details are often stricter than those of public bug bounty platforms (such as HackerOne).
HackerOne report #3086545 demonstrates an attack using Unicode Tag character blocks (U+E0000–U+E007F) for invisible prompt injection.
HackerOne researcher Paulos Yibelo (pwn.ai) discovered defects in the Linux kernel network protocol stack in a standard sandbox environment, and by sending carefully crafted packets from within the microVM achieved three kinds of attacks: host memory disclosure, crash, and code execution.
GitHub's bug bounty program runs on the HackerOne platform.
On most Bug Bounty platforms, rewards for vulnerability reports follow a first-come, first-served principle; if multiple people submit the same vulnerability, only the first confirmed report receives a bounty, and subsequent reports are marked as Duplicate and receive no reward.
Responsible disclosure of this vulnerability was completed by a HackerOne researcher.
Third-party aggregation platforms such as Butian, Vulnerability Box, and HackerOne uniformly manage white-hat identity verification, vulnerability acceptance standards, and bounty disbursement processes, with HackerOne targeting overseas vendors.
The srcHunter skill package recommended by the author contains 19 attack-oriented prompts, 263 payload entries, EDR-bypass content, 2,887 real vulnerability reports from HackerOne, and 88,636 historical WooYun cases.
HackerOne and Bugcrowd were both founded in 2012.
6 more timeline events
All Facts (20)
Representative domestic SRC platforms include Butian (operated by QiAnXin) and Vulbox, while internationally there are HackerOne and Bugcrowd.
65%VerifiedBug bounty programs are hosted on platforms such as HackerOne and Bugcrowd, where companies incentivize white-hat hackers to discover vulnerabilities by offering monetary rewards.
65%VerifiedHackerOne and Bugcrowd are currently the two largest bug bounty intermediary platforms in the world.
65%Unverified美国国防部、谷歌、微软等机构均是HackerOne的客户
85%UnverifiedHackerOne的Signal评分机制会追踪研究人员的历史提交质量，低质量提交会影响其平台声誉和未来参与高价值项目的资格
85%UnverifiedHackerOne was founded in 2012 and is currently one of the largest and most influential bug bounty platforms in the world.
70%UnverifiedThe curl project operates a bug bounty program through the HackerOne platform.
60%UnverifiedMainstream bug bounty platforms include HackerOne, Bugcrowd, and Intigriti, with participating companies spanning Google, Meta, and Microsoft.
60%UnverifiedThe Omarchy team has appointed a security lead and a security team, and runs a $100,000 bug bounty program on HackerOne.
50%UnverifiedDomestic SRCs are mostly built by enterprises themselves, with considerable variation in rules, and their requirements for report format and reproduction details are often stricter than those of public bug bounty platforms (such as HackerOne).
50%UnverifiedHackerOne researcher Paulos Yibelo (pwn.ai) discovered defects in the Linux kernel network protocol stack in a standard sandbox environment, and by sending carefully crafted packets from within the microVM achieved three kinds of attacks: host memory disclosure, crash, and code execution.
50%UnverifiedGitHub's bug bounty program runs on the HackerOne platform.
50%UnverifiedOn most Bug Bounty platforms, rewards for vulnerability reports follow a first-come, first-served principle; if multiple people submit the same vulnerability, only the first confirmed report receives a bounty, and subsequent reports are marked as Duplicate and receive no reward.
50%UnverifiedResponsible disclosure of this vulnerability was completed by a HackerOne researcher.
50%UnverifiedThird-party aggregation platforms such as Butian, Vulnerability Box, and HackerOne uniformly manage white-hat identity verification, vulnerability acceptance standards, and bounty disbursement processes, with HackerOne targeting overseas vendors.
50%UnverifiedThe srcHunter skill package recommended by the author contains 19 attack-oriented prompts, 263 payload entries, EDR-bypass content, 2,887 real vulnerability reports from HackerOne, and 88,636 historical WooYun cases.
50%UnverifiedHackerOne and Bugcrowd were both founded in 2012.
50%UnverifiedHackerOne platform data shows that as of 2023, the platform has cumulatively paid security researchers more than $300 million in bounties.
50%UnverifiedThe curl project operates a bug bounty program through the HackerOne platform, and Stenberg has referred to the behavior of submitting AI-generated false vulnerability reports as "AI security washing".
50%Unverified漏洞报告呈现分层：约80%的报告集中在20%的常见漏洞类型上，而高价值零日漏洞越来越难发现，研究投入呈指数级增长
50%