PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Year In HackerOne’s Bug Bounty Program

hackerone.com | blog | #bug-bounty | #metrics | #vulnerability-disclosure | #hackerone | #transparency | #annual-review
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's own bug bounty program saw an 89% jump in 2022 submissions, paying $163,134 across 56 findings at an average $2,862, with acquisitions and third-party flaws driving most reports.
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · hackerone.com
New CTEM Metrics That Matter: How to Brief Your Board on AI-Accelerated Exposure
HackerOne argues vulnerability counts no longer brief boards well and proposes CTEM metrics like Time to Validate, as AI-accelerated discovery compresses exploitation timelines.
blog · wiz.io
Increasing transparency in cloud security: Wiz is now a CVE Numbering Authority (CNA)
Wiz became a CVE Numbering Authority able to assign CVE IDs and disclose cloud vulnerabilities—the latest step after helping build the community cloud vulnerability database.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back