# HackerOne: bug bounty program on HackerOne

> HackerOne is a bug bounty program on HackerOne. Its critical reports have paid an average of $15,000 across 21 reports (HackerOne figures, November 7, 2026). It received 1,128 reports in the 90 days to November 7, 2026, about 30 per in-scope asset.

- **Company:** HackerOne
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/security
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** November 6, 2013
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/security

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $15,000 | 21 |
| High | $7,117 | 72 |
| Medium | $1,582 | 306 |
| Low | $170 | 386 |

- Reports received in the last 90 days: 1,128 (about 30 per in-scope asset)
- Bounties paid in the last 90 days: $66,969
- Bounties paid in total: $2,127,333
- Researchers participating: 916
- Response efficiency: 100%
- First-response target: 5 days
- Triage target: 2 days
- Bounty target: 2 days

## Scope

As imported from HackerOne on November 6, 2026: 37 assets in scope (33 bounty-eligible), 16 out of scope. The policy page is the authority.

- `*.hackerone-ext-content.com` (OTHER): in scope, bounty-eligible, max severity medium
- `*.hackerone-user-content.com` (OTHER): in scope, bounty-eligible, max severity low
- `*.vpn.hackerone.net` (OTHER): in scope, bounty-eligible, max severity critical
- `206.166.248.0/23` (CIDR): in scope, bounty-eligible, max severity critical
- `66.232.20.0/23` (CIDR): in scope, bounty-eligible, max severity critical
- `a5s.hackerone-ext-content.com` (URL): in scope, bounty-eligible, max severity medium
- `api.hackerone.com` (URL): in scope, bounty-eligible, max severity critical
- `app.pullrequest.com` (URL): in scope, bounty-eligible, max severity critical
- `b5s.hackerone-ext-content.com` (URL): in scope, bounty-eligible, max severity medium
- `cover-photos-us-east-2.hackerone-user-content.com` (URL): in scope, bounty-eligible, max severity low
- `cover-photos.hackerone-user-content.com` (URL): in scope, bounty-eligible, max severity low
- `ctf.hacker101.com` (URL): in scope, bounty-eligible, max severity low
- `errors.hackerone.net` (URL): in scope, bounty-eligible, max severity high
- `hackathon-photos-us-east-2.hackerone-user-content.com` (URL): in scope, bounty-eligible, max severity low
- `hackathon-photos.hackerone-user-content.com` (URL): in scope, bounty-eligible, max severity low
- `hackerone-attachments.s3.amazonaws.com` (URL): in scope, bounty-eligible, max severity critical
- `hackerone-ext-content.com` (URL): in scope, bounty-eligible, max severity medium
- `hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com` (URL): in scope, bounty-eligible, max severity critical
- `hackerone-user-content.com` (URL): in scope, bounty-eligible, max severity low
- `hackerone.live` (URL): in scope, bounty-eligible, max severity low
- `https://*.hackerone-ext-content.com` (URL): in scope, bounty-eligible, max severity medium
- `https://*.hackerone-user-content.com/` (URL): in scope, bounty-eligible, max severity low
- `https://app.pullrequest.com` (URL): in scope, bounty-eligible, max severity critical
- `https://ctf.hacker101.com` (URL): in scope, bounty-eligible, max severity low
- `https://hackerone-us-west-2-production-attachments.s3-us-west-2.amazonaws.com/` (URL): in scope, bounty-eligible, max severity critical
- `https://hackerone.com/mcp` (OTHER): in scope, bounty-eligible, max severity critical
- `https://reviewer.pullrequest.com` (URL): in scope, bounty-eligible, max severity critical
- `mta-sts.wearehackerone.com` (URL): in scope, bounty-eligible, max severity critical
- `profile-photos-us-east-2.hackerone-user-content.com` (URL): in scope, bounty-eligible, max severity low
- `profile-photos.hackerone-user-content.com` (URL): in scope, bounty-eligible, max severity low
- `reviewer.pullrequest.com` (URL): in scope, bounty-eligible, max severity critical
- `www.hackerone.com` (URL): in scope, bounty-eligible, max severity critical
- `www.wearehackerone.com` (URL): in scope, bounty-eligible, max severity critical
- `app.qualified.dev` (URL): out of scope, max severity none
- `events.hackerone.com` (URL): out of scope, max severity none
- `go.hacker.one` (URL): out of scope, max severity none
- `h1.community` (URL): out of scope, max severity none
- `hackerone-swag.com` (URL): out of scope, max severity none
- `hackerone-test.com` (URL): out of scope, max severity none
- `hackerone.com` (URL): in scope, no bounty, max severity critical
- and 13 more on the BugRater page

## What researchers say on BugRater

- Would submit again: 100%
- Average rating: 4 of 5

**Hacktivity: HackerOne (100 disclosed)** (An anonymous researcher, October 1, 2026, 4 of 5)

Source: HackerOne Hacktivity (public disclosures) Program: https://hackerone.com/security Disclosed reports analyzed: 100 Bounties: $4,714 avg, $25,000 range, $84,850 total (18 paid) --- Aggregated from publicly disclosed HackerOne reports. Ratings derived from triage timing and bounty data.

## Recent public accepted findings

- October 8, 2026: low severity, awarded $200
- October 1, 2026: critical severity, awarded $15,000
- September 24, 2026: low severity, awarded $200
- July 29, 2026: high severity
- June 17, 2026: high severity, awarded $7,000

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.