BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.
Programs / Chainlink
NR Unrated
Chainlink
Chainlink HackerOne
3 more reviews needed for a grade
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at Chainlink? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.

Ask BugRater to submit it

Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.

Program metrics HackerOne · published

HackerOne’s own figures for this program, read from its public page, not reported by researchers and not part of the BugRater grade. Captured 24 Sep 2026.

What it pays, by severity

Critical amount not published 4 reports
High amount not published 11 reports
Medium amount not published 38 reports
Low $100 avg 53 reports firm

$310,000 paid to researchers in total, $5,000 of it in the last 90 days. Lifetime figure as HackerOne prints it: evidence this program has paid, not a promise about any one report.

Intake & responsiveness · last 90 days

Reports received
487
in 90 days
Resolved
138
all time, last one 13 days ago
Participants
99
hunters engaged
Response efficiency
16%
failed, HackerOne’s figure
SLA misses
0
targets missed
Reports received · day by day, last 15 days 487–504
27 Aug 487 reports 24 Sep

Response targets it sets itself

First response
3 days
Triage
5 days
Bounty
30 days
Resolution
30 days

A target the program declared, not a measurement of it being met.

Getting in the door

bounty amounts hidden

Over 33 days (18 snapshots): intake up 2 reports; response efficiency down 5 points.

See how this programme’s report load compares to others →

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

105 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 mwhx-404 395 21 / 47 45%
1 gujjuboy10x00 118 9 / 11 82%
2 novemberelang 266 15 / 31 48%
3 pesticide 261 8 / 15 53%
4 asm0d3us 126 4 / 24 17%
5 t4ym 109 2 / 4 50%
6 sup3r-b0y 101 8 / 9 89%
6 padillac 89 1 / 1 100%
7 proabiral 76 3 / 3 100%
8 holybugx 66 4 / 6 67%
9 nathand 57 1 / 1 100%
9 talko 57 1 / 2 50%
11 fdeleite 54 2 / 2 100%
11 itsunixiknowthis 54 2 / 2 100%
13 aviv_keller 44 2 / 4 50%
13 hussain_0x3c 44 2 / 2 100%
13 milankatwal99 44 2 / 4 50%
13 odeke 44 2 / 4 50%
13 r0s3 44 2 / 2 100%
18 panveany 42 1 / 7 14%
18 sheikhrishad0 42 2 / 14 14%
20 moscowchill 37 1 / 2 50%
20 nungki 37 1 / 3 33%
20 the_official_c0ldn3s5 37 1 / 7 14%
20 xitro 37 0 / 4 0%

Showing the top 25 of 105 credited on HackerOne.

Program profile HackerOne · imported

Facts published by HackerOne on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 23 Sep 2026.

Responsiveness
16% HackerOne’s figure
Swag
No
Currency
USD
Submissions
Open
Launched
May 2019
Scope entries
29 HackerOne’s count

Scope

28 assets
AssetTypeEligibilityMax severity
Explorer OTHER ✓ bounty High
Faucets OTHER ✓ bounty High
https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts SMART CONTRACT ✓ bounty Critical
https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts SMART CONTRACT ✓ bounty Critical
https://github.com/smartcontractkit/external-adapters-js/ SOURCE CODE ✓ bounty High
Show all 28 assets
AssetTypeEligibilityMax severity
https://github.com/smartcontractkit/staking-v0.1/tree/master/contracts SMART CONTRACT ✓ bounty Critical
kovan.chain.link URL ✓ bounty High
rinkeby.chain.link URL ✓ bounty High
ropsten.chain.link URL ✓ bounty High
*.smartcontract.com WILDCARD submit only None
blog.chain.link URL out None
chain.link URL submit only Medium
chainlinklabs.com URL out None
create.smartcontract.com URL out None
docs.chain.link URL out None
github.com/smartcontractkit/chainlink/contracts/src/*/dev SOURCE CODE out None
github.com/smartcontractkit/chainlink/evm/app SOURCE CODE out None
github.com/smartcontractkit/chainlink/examples SOURCE CODE out None
https://github.com/smartcontractkit/chainlink SMART CONTRACT out None
https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts/.../dev SMART CONTRACT out None
https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts/.../dev SMART CONTRACT out None
https://github.com/smartcontractkit/chainlink/tree/master/contracts SMART CONTRACT out None
https://github.com/smartcontractkit/chainlink/tree/master/core/internal SOURCE CODE out None
https://github.com/smartcontractkit/chainlink/tree/master/core/sgx SOURCE CODE out None
https://github.com/smartcontractkit/chainlink/tree/master/integration SOURCE CODE out None
https://github.com/smartcontractkit/chainlink/tree/master/tools SOURCE CODE out None
Intercom OTHER out None
testnet.smartcontract.com URL out None

HackerOne lists 29 scope entries; its public listing groups many assets under one label, so identical entries are shown once.