BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.
Programs / Box BB
NR Unrated
Box BB
Box BB HackerOne
3 more reviews needed for a grade
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at Box BB? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.

Ask BugRater to submit it

Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.

Program metrics HackerOne · published

HackerOne’s own figures for this program, read from its public page, not reported by researchers and not part of the BugRater grade. Captured 21 Sep 2026.

What it pays, by severity

Critical $5,000 avg 18 reports indicative
High $2,000 avg 67 reports firm
Medium $268 avg 94 reports firm
Low $150 avg 36 reports firm

$267,350 paid to researchers in total, $77,150 of it in the last 90 days. Lifetime figure as HackerOne prints it: evidence this program has paid, not a promise about any one report.

Intake & responsiveness · last 90 days

Reports received
1,207
in 90 days
Resolved
218
all time, last one 4 days ago
Participants
155
hunters engaged
Response efficiency
97%
meeting its targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received · day by day, last 20 days 659–1,207
24 Aug 1,207 reports 21 Sep

Response targets it sets itself

First response
2 days
Triage
10 days
Bounty
30 days
Resolution
30 days

A target the program declared, not a measurement of it being met.

Getting in the door

Open to submit. Nothing HackerOne publishes stands between a hunter and a first report here.

Over 31 days (24 snapshots): intake up 609 reports; response efficiency down 2 points; 90-day payout up $43,150.

See how this programme’s report load compares to others →

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

131 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 luqii 4,259 111 / 138 80%
2 freesec 432 15 / 25 60%
3 m0chan 285 12 / 27 44%
4 imran0x01 162 6 / 7 86%
5 yoghurtbrain 145 0 / 0
6 gammarex 136 3 / 3 100%
7 h1-squirtle 91 3 / 9 33%
8 hamza_g 90 5 / 8 63%
8 yashvier_kosaraju 90 5 / 6 83%
10 h33tjev 88 4 / 4 100%
10 ninetynine 88 4 / 4 100%
12 mugalatoogin 77 0 / 15 0%
13 imran_nisar 69 3 / 8 38%
14 fr4via 64 0 / 0
14 shailesh4594 64 2 / 2 100%
16 cdl 57 1 / 1 100%
16 geekninja 57 1 / 1 100%
16 noam_ 57 0 / 0
16 prateek_0490 57 1 / 1 100%
16 thaivu 57 1 / 1 100%
19 h4x0r_dz 29 2 / 2 100%
21 kotko 47 1 / 9 11%
22 brdoors3 42 0 / 12 0%
23 antonade 35 0 / 2 0%
23 danish_bhat786 35 0 / 2 0%

Showing the top 25 of 131 credited on HackerOne.

Program profile HackerOne · imported

Facts published by HackerOne on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 16 Sep 2026.

Responsiveness
97% HackerOne’s figure
Swag
No
Currency
USD
Submissions
Open
Launched
Aug 2026
Scope entries
38 HackerOne’s count

Scope

37 assets
AssetTypeEligibilityMax severity
account.box.com URL ✓ bounty Critical
Android Box Mobile App GOOGLE PLAY APP ID ✓ bounty Critical
api.box.com URL ✓ bounty Critical
app.box.com URL ✓ bounty Critical
Box Drive OTHER ✓ bounty Critical
Show all 37 assets
AssetTypeEligibilityMax severity
Box Tools OTHER ✓ bounty Critical
cloud.app.box.com URL ✓ bounty Critical
dl.boxcloud.com URL ✓ bounty Critical
http://api.box.com/2.0/collaborations/ URL ✓ bounty Critical
http://api.box.com/2.0/collections/ URL ✓ bounty Critical
http://api.box.com/2.0/events/ URL ✓ bounty Critical
http://api.box.com/2.0/files/ URL ✓ bounty Critical
http://api.box.com/2.0/folder_locks/ URL ✓ bounty Critical
http://api.box.com/2.0/folders/ URL ✓ bounty Critical
http://api.box.com/2.0/group_memberships URL ✓ bounty Critical
http://api.box.com/2.0/groups URL ✓ bounty Critical
http://api.box.com/2.0/invites/ URL ✓ bounty Critical
http://api.box.com/2.0/recent_items/ URL ✓ bounty Critical
http://api.box.com/2.0/search/ URL ✓ bounty Critical
http://api.box.com/2.0/shared_items/ URL ✓ bounty Critical
http://api.box.com/2.0/skill_invocations/ URL ✓ bounty Critical
http://api.box.com/2.0/users/ URL ✓ bounty Critical
http://api.box.com/2.0/web_links/ URL ✓ bounty Critical
http://api.box.com/2.0/webhooks/ URL ✓ bounty Critical
http://api.box.com/2.0/zip_downloads/ URL ✓ bounty Critical
http://app.box.com/master/content URL ✓ bounty Critical
http://cloud.app.box.com/notes URL ✓ bounty Critical
http://dl.boxcloud.com/2.0/zip_downloads/ URL ✓ bounty Critical
http://upload.box.com/api/2.0/files/ URL ✓ bounty Critical
iOS Box Mobile App APPLE STORE APP ID ✓ bounty Critical
m.box.com URL ✓ bounty Critical
notes.services.box.com URL ✓ bounty Critical
upload.box.com URL ✓ bounty Critical
http://api.box.com/2.0/comments URL out None
http://app.box.com/tasks URL out None
signrequest.com URL out None
sr-staging-1.com URL out None

HackerOne lists 38 scope entries; its public listing groups many assets under one label, so identical entries are shown once.