What is HackerOne?
HackerOne's documentation distinguishes vulnerability disclosure programs from bug bounty programs. Both require a clear scope and response process; a bounty adds reward rules. Public and private program settings can differ.
Read the full overview
Sources checked 27 September 2026: Program types, Disclosure guidelines.
HackerOneVulnerability ManagementCoordinate vulnerability reports and bounty programs
Key capabilities
- Program setup: Define eligible assets and reporting terms.
- Report handling: Receive and triage researcher findings.
- Coordination: Track remediation and disclosure decisions.
Where HackerOne fits
Vulnerability intake and researcher coordination are the core product functions.
Positioning and limitations
Use HackerOne when an organization is prepared to receive, triage and resolve external security reports. Write the scope, safe-harbor language and internal ownership before inviting submissions.
The program's quality depends on timely, consistent treatment of a valid report, not simply publishing a bounty page.
“Coordinate vulnerability reports and bounty programs”
Technical details
- Access
- See vendor
- Source model
- Commercial
- License
- Commercial
- Founded
- 2012
- Headquarters
- San Francisco, California, USA
- Pricing model
- Freemium
- API
- Available
- Website
- www.hackerone.com ↗
What to verify
Start from the users, systems and operating responsibilities the tool needs to support.
- Confirm current features, licensing and support terms.
- Validate deployment, data location and access control.
- Test integrations, exports and recovery workflows.
Reviews of HackerOne
No published reviews yet.
Loading review form…
