Hacker News new | ask | show | jobs
by thaumasiotes 2301 days ago
HackerOne, itself, is pretty generous about reported bugs. (As in, you reported an issue in the website hackerone.com.) They have to be, because their existence depends on everyone thinking bug bounty platforms are a good idea -- it's part of their way of encouraging people to hunt for bug bounties in general.

Payouts for bugs in other products are determined by those companies, not by H1.
2 comments
lonelappde 2301 days ago
The point of being a branded platform is that you take responsibility for the activity on your platform. Otherwise you are just an email gateway.
link
thaumasiotes 2301 days ago
It is possible to escalate your dispute with a company to H1 itself. They'll review the report and the company's policy, and they may contact the triager or the company to try to resolve any questions.

I wouldn't do that as a regular thing; you're pretty well guaranteed to piss off everyone on the company's side of things.

I should note that I've personally seen probably in excess of $100,000 paid out through H1; the payouts do happen.

link
ohithereyou 2301 days ago
That sounds like it's a payout lottery. H1 can't force its customers to pay. It's acting as a go-between on behalf of its customer, the company offering the bounty, not as an neuteal arbiter when there is a dispute.

Perhaps I would take them seriously if there was an escrow account companies paid into and was released to the reporting party when a plurality of multiple, disinterested parties agreed that the report was valid.

link
WUHANCLAN 2301 days ago
HackerOne can force their customers to pay, that's the entire point of their "guaranteed bounty" program, that's it's a guaranteed bounty!

Even with a guaranteed bounty and a critical security vulnerability, HackerOne will punt the entire thing to one of their Portswigger groupies for collection and then won't disclose the details about the discovered flaw that supposedly they found prior to your submission.

Those guys are terrible, worthless product offering unless you are one of their clients getting free penetration testing and vulnerability analysis services.

link
WUHANCLAN 2301 days ago
Bah no they aren't, HackerOne has a small collective of security testers that they consistently make awards to, over and over again. If you submit a critical vulnerability, magically one of HackerOne's top ranked folk end up getting the award, AND HackerOne won't share any aspect of that triage information with you to actually prove that the vulnerability you submitted was legitimately discovered prior to your submission.

Junk company, waste of time and effort which results in all of their clients getting 95% free security analysis services.

link