How crowded is a
programme, really?

Where the fire is most concentrated

The programmes taking the most reports per in-scope asset over the last 90 days, among those with at least 20 reports in the window so the ratio is not built on a handful. Reports per participant sits beside it to separate a swarm of many hunters from a few people filing a lot. This is a description of traffic, not a judgement: a crowded programme is usually just a popular one.

Two things this cannot see, said plainly. It is an average across the scope: a low figure does not promise any single asset is quiet, and a high one does not mean every asset is busy, because the traffic may sit on a few hot targets. And a high report count says nothing about the quality of those reports; we hold no data on quality and make no claim about it.

Where to go instead

The useful half. Programmes that are open to submit, offer bounties, have paid out on the record, and carry a low report load per asset. Same measure, read from the other end. This is a shortlist to go and look at, ordered by how much room there looks to be.

How many walk out with anything

Crowding counts the people in the room. This counts what they got. For every researcher a programme publicly credits, HackerOne prints how much that person submitted and how much of it was recognised. Summed across a programme's credited hunters, that is a recognition rate, and it is the number a hunter most wants before spending a weekend. Ranked lowest first, among programmes whose credited hunters have submitted at least 200 reports, so a rate is never printed off a handful.

Read this before the numbers. A thanks list is wider than it sounds. A researcher appears on it once a report of theirs reaches triage, which happens well before anyone decides the report was worth anything, so the list includes plenty of people who ended up with nothing. In the lists we hold, 18.6% of entries have zero recognised reports, some of them after dozens of submissions. So the denominator here is not a roll of successful hunters.

What it still misses is anyone whose reports were closed before a human triaged them, as a duplicate, out of scope or spam. Those people leave no trail at all. That makes these figures slightly generous rather than wildly so: read them as a near ceiling, not as a rate across everyone who ever pressed submit.

And a low rate is not evidence that a programme is unfair, nor evidence about the quality of what was sent to it. Duplicates, out-of-scope submissions and informatives all land in the gap between submitted and recognised, and this data cannot tell those apart any more than it can tell apart the three causes of a quiet programme. The numbers are the evidence; the explanation is not in them.

Which programmes are
taking work in faster than usual

Everything above is a level: how busy a programme is right now. A level cannot tell you whether you are looking at six years of steady state or at a week that has changed everything, and the second is what decides a weekend. So this board reads rate of change against a programme's own baseline over the last 7 days.

A programme live for six years holding eight thousand reports sits at 1.00× here, because eight thousand is its normal. The same programme taking another seven thousand in a week does not. That is the comparison, and it is why raw volume is nowhere in this ranking.

What the intake column is, exactly. HackerOne publishes reports received in the last 90 days as a rolling window, not a running total, so the difference between two readings is new arrivals minus reports that aged out of the window. It is never the number of reports a programme received since we last looked, and nothing here adds those differences up and calls them new reports. What the difference honestly measures is how much faster a programme is taking work in now than it was ninety days ago, which is why a steady programme sits at zero however large it is. Resolution and new hunters come from lifetime counters that only ever go up, so those two ARE true rates.

A programme moving is not a programme going wrong. It may have launched something, shipped a release, been written about, widened its scope or raised its rewards. This board measures how much the traffic changed and never why, it says nothing at all about the quality of what was sent, and a high figure here is information for planning a weekend, not a mark against anyone.

Programmes with no baseline yet

A programme that opened this week has no history to be a multiple of, so the board above cannot place it. This one can, with the only measure that needs no history at all: reports per hour since it opened, for programmes launched in the last 90 days. Ranked fastest first.

Why this figure is exact and the one above is an estimate. A programme younger than 90 days has had nothing age out of HackerOne's rolling 90-day window yet, so that count IS every report it has ever received. Divided by its age, that is a true reports-per-hour rate rather than a difference of rates. Past 90 days the equality stops holding and a programme leaves this board rather than carrying a figure that has quietly become wrong.

Read this beside the assets column. A hundred reports spread over eighty in-scope assets is a busy launch; the same hundred against a single asset is a very different weekend. And as everywhere on this page, none of it says anything about what those reports contained: the quality of a programme's intake is not published anywhere and we do not infer it.